Package: pipdeptree
pipdeptreepipdeptreeis a command line utility for displaying the installed python packages in form of a dependency tree. It
works for packages installed globally on a machine as well as in a virtualenv. Sincepip freezeshows all dependencies
as a flat list, finding out which are the top level packages and which packages do they depend on requires some effort.
It's also tedious to resolve conflicting dependencies that could have been installed because older version ofpipdidn't have true dependency resolution[^1].pipdeptreecan help here by identifying conflicting dependencies
installed in the environment.To some extent,pipdeptreeis inspired by thelein deps :treecommand ofLeiningen.InstallationpipinstallpipdeptreeRunning in virtualenvsNew in ver. 2.0.0If you want to run pipdeptree in the context of a particular virtualenv, you can specify the--pythonoption. Note
that this capability has been recently added in version2.0.0.Alternatively, you may also install pipdeptree inside the virtualenv and then run it from there.Usage and examplesTo give you a brief idea, here is the output ofpipdeptreecompared withpip freeze:$pipfreezeFlask==0.10.1itsdangerous==0.24Jinja2==2.11.2
-egit+git@github.com:naiquevin/lookupy.git@cdbe30c160e1c29802df75e145ea4ad903c05386#egg=LookupyMarkupSafe==0.22
pipdeptree@file:///private/tmp/pipdeptree-2.0.0b1-py3-none-any.whlWerkzeug==0.11.2And now see whatpipdeptreeoutputs,$pipdeptree
Warning!!!Possiblyconflictingdependenciesfound:
*Jinja2==2.11.2-MarkupSafe[required:>=0.23,installed:0.22]------------------------------------------------------------------------Flask==0.10.1-itsdangerous[required:>=0.21,installed:0.24]-Jinja2[required:>=2.4,installed:2.11.2]-MarkupSafe[required:>=0.23,installed:0.22]-Werkzeug[required:>=0.7,installed:0.11.2]Lookupy==0.1pipdeptree==2.0.0b1-pip[required:>=6.0.0,installed:20.1.1]setuptools==47.1.1wheel==0.34.2Is it possible to find out why a particular package is installed?New in ver. 0.5.0Yes, there's a--reverse(or simply-r) flag for this. To find out which packages depend on a particular
package(s), it can be combined with--packagesoption as follows:$pipdeptree--reverse--packagesitsdangerous,MarkupSafe
Warning!!!Possiblyconflictingdependenciesfound:
*Jinja2==2.11.2-MarkupSafe[required:>=0.23,installed:0.22]------------------------------------------------------------------------itsdangerous==0.24-Flask==0.10.1[requires:itsdangerous>=0.21]MarkupSafe==0.22-Jinja2==2.11.2[requires:MarkupSafe>=0.23]-Flask==0.10.1[requires:Jinja2>=2.4]What's with the warning about conflicting dependencies?As seen in the above output,pipdeptreeby default warns about possible conflicting dependencies. Any package that's
specified as a dependency of multiple packages with different versions is considered as a conflicting dependency.
Conflicting dependencies are possible if older version of pip<=20.2
(without the new resolver[^2]) was ever used to install dependencies at some
point. The warning is printed to stderr instead of stdout and it can be completely silenced by specifying the-w silenceor--warn silenceoption. On the other hand, it can be made mode strict with--warn fail, in which case
the command will not only print the warnings to stderr but also exit with a non-zero status code. This is useful if you
want to fit this tool into your CI pipeline.Note: The--warnoption is added in version0.6.0. If you are using an older version, use--nowarnflag to
silence the warnings.Warnings about circular dependenciesIn case any of the packages have circular dependencies (eg. package A depends on package B and package B depends on
package A), thenpipdeptreewill print warnings about that as well.$pipdeptree--excludepip,pipdeptree,setuptools,wheel
Warning!!!Cyclicdependenciesfound:
-CircularDependencyA=>CircularDependencyB=>CircularDependencyA
-CircularDependencyB=>CircularDependencyA=>CircularDependencyB
------------------------------------------------------------------------wsgiref==0.1.2argparse==1.2.1Similar to the warnings about conflicting dependencies, these too are printed to stderr and can be controlled using the--warnoption.In the above example, you can also see--excludeoption which is the opposite of--packagesie. these packages will
be excluded from the output.Using pipdeptree to write requirements.txt fileIf you wish to track only top level packages in yourrequirements.txtfile, it's possible by grep-ing[^3]. only the
top-level lines from the output,$pipdeptree--warnsilence|grep-E'^\w+'Flask==0.10.1gnureadline==8.0.0Lookupy==0.1pipdeptree==2.0.0b1setuptools==47.1.1wheel==0.34.2There is a problem here though - The output doesn't mention anything aboutLookupybeing installed as aneditablepackage (refer to the output ofpip freezeabove) and information about its source is lost. To fix this,pipdeptreemust be run with a-for--freezeflag.$pipdeptree-f--warnsilence|grep-E'^[a-zA-Z0-9\-]+'Flask==0.10.1gnureadline==8.0.0
-egit+git@github.com:naiquevin/lookupy.git@cdbe30c160e1c29802df75e145ea4ad903c05386#egg=Lookupy
pipdeptree@file:///private/tmp/pipdeptree-2.0.0b1-py3-none-any.whlsetuptools==47.1.1wheel==0.34.2

$pipdeptree-f--warnsilence|grep-E'^[a-zA-Z0-9\-]+'>requirements.txtThe freeze flag will not prefix child dependencies with hyphens, so you could dump the entire output ofpipdeptree -fto the requirements.txt file thus making it human-friendly (due to indentations) as well as pip-friendly.$pipdeptree-f|teelocked-requirements.txtFlask==0.10.1itsdangerous==0.24Jinja2==2.11.2MarkupSafe==0.23Werkzeug==0.11.2gnureadline==8.0.0
-egit+git@github.com:naiquevin/lookupy.git@cdbe30c160e1c29802df75e145ea4ad903c05386#egg=Lookupy
pipdeptree@file:///private/tmp/pipdeptree-2.0.0b1-py3-none-any.whlpip==20.1.1setuptools==47.1.1wheel==0.34.2On confirming that there are no conflicting dependencies, you can even treat this as a "lock file" where all packages,
including the transient dependencies will be pinned to their currently installed versions. Note that thelocked-requirements.txtfile could end up with duplicate entries. Althoughpip installwouldn't complain about
that, you can avoid duplicate lines (at the cost of losing indentation) as follows,$pipdeptree-f|sed's/ //g'|sort-u>locked-requirements.txtUsing pipdeptree with external toolsNew in ver. 0.5.0It's also possible to havepipdeptreeoutput json representation of the dependency tree so that it may be used as
input to other external tools.$pipdeptree--jsonNote that--jsonwill output a flat list of all packages with their immediate dependencies. This is not very useful in
itself. To obtain nested json, use--json-treeNew in ver. 0.11.0$pipdeptree--json-treeVisualizing the dependency graphThe dependency graph can also be visualized usingGraphViz:$pipdeptree--graph-outputdot>dependencies.dot
$pipdeptree--graph-outputpdf>dependencies.pdf
$pipdeptree--graph-outputpng>dependencies.png
$pipdeptree--graph-outputsvg>dependencies.svgNote thatgraphvizis an optional dependency ie. required only if you want to use--graph-output. If the version ofgraphvizinstalled in the env is older than 0.18.1, then a warning will be displayed about upgradinggraphviz.
Support for older versions of graphviz will be dropped soon.Since version2.0.0b1,--packageand--reverseflags are supported for all output formats ie. text, json,
json-tree and graph.In earlier versions,--json,--json-treeand--graph-outputoptions override--packageand--reverse.Usage%pipdeptree--help
usage:pipdeptree[-h][-v][-w[{silence,suppress,fail}]][--pythonPYTHON][-pP][-eP][-a][-l|-u][-f][--encodingE][-dD][-r][--license][-j|--json-tree|--mermaid|--graph-outputFMT]Dependencytreeoftheinstalledpythonpackages

options:-h,--helpshowthishelpmessageandexit-v,--versionshowprogram's version number and exit-w [{silence,suppress,fail}], --warn [{silence,suppress,fail}]warning control: suppress will show warnings but return 0 whether or not they are present; silence will not show warnings at all and always return 0; fail will show warnings and return 1 if any are present (default:suppress)select:choose what to render--python PYTHON     Python interpreter to inspect (default: /usr/local/bin/python)-p P, --packages P  comma separated list of packages to show - wildcards are supported, like 'somepackage.*' (default: None)-e P, --exclude P   comma separated list of packages to not show - wildcards are supported, like 'somepackage.*'.(cannotcombinewith-por-a)(default:None)-a,--alllistalldepsattoplevel(default:False)-l,--local-onlyifinavirtualenvthathasglobalaccessdonotshowgloballyinstalledpackages(default:False)-u,--user-onlyonlyshowinstallationsintheusersitedir(default:False)render:choosehowtorenderthedependencytree(bydefaultwillusetextmode)-f,--freezeprintnamessoastowritefreezefiles(default:False)--encodingEtheencodingtousewhenwritingtotheoutput(default:utf-8)-dD,--depthDlimitthedepthofthetree(textrenderonly)(default:inf)-r,--reverserenderthedependencytreeinthereversefashionie.thesub-dependenciesarelistedwiththelistofpackagesthatneedthemunderthem(default:False)--licenselistthelicense(s)ofapackage(textrenderonly)(default:False)-j,--jsonrawJSON-thiswillyieldoutputthatmaybeusedbyexternaltools(default:False)--json-treenestedJSON-mimicsthetextformatlayout(default:False)--mermaidhttps://mermaid.js.orgflowdiagram(default:False)--graph-outputFMTGraphvizrenderingwiththevaluebeingthegraphvizoutpute.g.:dot,jpeg,pdf,png,svg(default:None)Known issuespipdeptreerelies on the internal API ofpip. I fully understand that it's a bad idea but it mostly works! On
rare occasions, it breaks when a new version ofpipis out with backward incompatible changes in internal API. So
beware if you are using this tool in environments in whichpipversion is unpinned, specially automation or CD/CI
pipelines.Limitations & Alternativespipdeptreemerely looks at the installed packages in the current environment using pip, constructs the tree, then
outputs it in the specified format. If you want to generate the dependency tree without installing the packages, then
you need a dependency resolver. You might want to check alternatives such aspipgriporpoetry.LicenseMIT (SeeLICENSE)Footnotes[^1]:
pip version 20.3 has been released in Nov 2020 with the dependency resolver
<https://blog.python.org/2020/11/pip-20-3-release-new-resolver.html>_[^2]:
pip version 20.3 has been released in Nov 2020 with the dependency resolver
<https://blog.python.org/2020/11/pip-20-3-release-new-resolver.html>_[^3]:
If you are on windows (powershell) you can runpipdeptree --warn silence | Select-String -Pattern '^\w+'instead
of grep