WebDev/Deployments: Difference between revisions

Line 15: Line 15:
   foo==0.3
   foo==0.3


Use of <code>>=</code> or not pinning to a version is not recommended. This can mean untrusted versions of packages being installed.
Use of <code>>=</code> or not pinning to a version is not recommended. This can mean broken untested versions of packages being installed.


When running pip use the flag: <code>--no-deps</code>. This ensures that packages will not pull in more untrusted versions of packages. It also means that the requirements files are a definitive source of packages used. This allows security faster audits of who is using what package.
When running pip use the flag: <code>--no-deps</code>. This ensures that packages will not pull in more untested versions of packages. It also means that the requirements files are a definitive source of packages used. This allows security faster audits of who is using what package.


==Internal package server==
==Internal package server==
Confirmed users
28

edits