Package: pipxl
pipxlAdditional tools for pip - compile, sync, deptree & licenseInstallationpip install pipxlFeaturespipxlis a wrapper aroundpip, the default Python package manager.pipxladds the following topip:pipxl compile: from a list of top-level dependencies, generate a pip-compliant requirements file with all dependencies and dependencies-of-dependencies pinnedpipxl sync: sync current environment with the requirements filepipxl deptree: show for a set of packages the dependencies and dependencies-of-dependencies including all version specifierspipxl deptreerev: show for a set of packages the dependency tree in reversepipxl license: list the licensing of the dependencies, including sub-dependencies, in an easy formatcompileCompile can take in apyproject.tomlfile, one or more requirements file and direct package specifications, including combinations of those:#pyproject.toml$pipxlcompile.#pyproject.toml,withcustomoutput_file.Defaultstorequirements_lock.txt$pipxlcompile.--omy_requirements_lock.txt#pyproject.toml,includingoptionaldependenciesdefinedunder`all`$pipxlcompile.[all]#singlerequirementsfile$pipxlcompile--rrequirements.in#multiplerequirementsfiles$pipxlcompile--rrequirements.in--rrequirements-dev.in#directpackagespecifications$pipxlcompilepandas==1.4.3The generated file includes all packages, with version, the correct hash, and detailed version information for why the dependency was included:pandas==1.4.3 \
    --hash=sha256:6f803320c9da732cc79210d7e8cc5c8019aad512589c910c66529eb1b1818230
numpy==1.23.3 \
    --hash=sha256:004f0efcb2fe1c0bd6ae1fcfc69cc8b6bf2407e0f18be308612007a0762b4089
    # via pandas [numpy (>=1.21.0) ; python_version >= "3.10"]
python-dateutil==2.8.2 \
    --hash=sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9
    # via pandas [python-dateutil (>=2.8.1)]
pytz==2022.2.1 \
    --hash=sha256:220f481bdafa09c3955dfbdddb7b57780e9a94f5127e35456a48589b9e0c0197
    # via pandas [pytz (>=2020.1)]
six==1.16.0 \
    --hash=sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254
    # via python-dateutil [six (>=1.5)]syncSync updates the active (virtual) environment:$pipxlsync--rrequirements_lock.txtdeptreeThedeptreecommand shows the dependency tree, listing for each requested package all dependencies, dependencies-of-dependencies, and so on.#pyproject.toml$pipxldeptree....#directpackagespecification$pipxldeptreepandas==1.4.3pandas==1.4.3python-dateutil==2.8.2 [python-dateutil (>=2.8.1)]six==1.16.0 [six (>=1.5)]pytz==2022.2.1 [pytz (>=2020.1)]numpy==1.23.3 [numpy (>=1.21.0) ; python_version >= "3.10"]deptreerevThe output ofdeptreeworks top-down: for every requested package, the dependencies are listed.deptreerevworks the opposite way: for each package, it lists the packages that depend on it.
This is useful to figure out why a particular dependency has been installed.$pipxldeptreerevpandas==1.4.3numpy==1.21.1pandas==1.4.3numpy==1.21.1pandas==1.4.3 [numpy (>=1.21.0) ; python_version >= "3.10"]python-dateutil==2.8.2pandas==1.4.3 [python-dateutil (>=2.8.1)]pytz==2022.2.1pandas==1.4.3 [pytz (>=2020.1)]six==1.16.0python-dateutil==2.8.2 [six (>=1.5)]pandas==1.4.3 [python-dateutil (>=2.8.1)]This shows that for instancesixis a dependency ofpython-dateutil, which in turn is a dependency ofpandas. In square brackets, you can see how the dependency has been defined. For example,python-dateutilrequiressix >= 1.5; the pip resolver has selected the most recent version1.16.0.licenseNot all packages on PyPi are licensed for usage in all environments, particularly not in corporate environments.
It is thus useful to check under which license the package comes.
The problem is complicated by dependencies of the dependencies; there are typically a large number of those and they may change over time.
Thelicensecommands collects all dependencies and dependencies-of-dependencies, and groups the output by license.
Do note that some packages may not have uploaded the license information (properly) to PyPi.
For those,*UNKNOWN*will be displayed.pipxldoes not attempt to extract it from Github, the wheel, or other sources, as it may result in the wrong license being assigned.#pyproject.toml$pipxllicense....$pipxllicensepandas==1.4.3BSD                 : numpyBSD-3-Clause        : pandasDual License        : python-dateutilMIT                 : pytz, sixWhy pipxl?pipxlis a set of additional tools topipthat I wish would be part ofpip, as they are useful in nearly every Python project I work on.Initial inspiration for creatingpipxlcomes from the release of pip22.2, which adds the following topip install--dry-runflag to not actually install packagesa reports flag providing detailed JSON output of the resolution process.In combination, the two allow us to pass a set of requirements to pip, and get the results of the resolver without hooking into the pip api. Alternatives, most with a narrower scope, such aspip-toolsdo hook into the api, but it isnot official and not recommended, although for lack of alternatives (until pip 22.2!) various packages do use it. By using the CLI, the risk of breakage on pip version upgrades should be limited (although the JSON report may change).What is still missing is being able to provide a list of packages to be considered installed, as to make use of the--upgrade-strategy=only-if-neededoption. Right now,pipxlwill eagerly upgrade all packages not requested (i.e. dependencies-of-dependencies), as it cannot simulate this behavior currently.
In theory, it could set up a temporary virtual environment, actually install current packages, dry-run pip install with theonly-if-neededflag, and record the results.Non-goalsDependency resolution:pipxluses the pip resolver, and does not, and will not, try to aid pip.pipxlis geared towards explaining whatpip, and in particular the pip resolver, does, not replacing it.Alternativespip-tools: offerspip-compileandpip-sync, similar topipxl lockandpipxl sync. Relies on pip internals. Seethis issuefor using the pip CLI interface instead.pipgrip: pip dependency resolver using the PubGrub algorithm, useful for viewing dependency treespipdeptree: offers functionality similar topipxl deptreeandpipxl deptreerevdep_license: offers functionality similar topipxl licensepoetry: alternative to pippdm: alternative to pipLicensepipxlis distributed under the terms of theMITlicense.