Patterns for requirements files, constraints, repeatable installs, hashes, wheelhouses, and reproducible environments.
Require hash verification for all requirements.
python -m pip install --require-hashes -r requirements.txtAdds integrity verification and stronger reproducibility to dependency installs.
Download all requirements into a local artifact directory.
python -m pip download -r requirements.txt -d ./wheelhouseUseful for prefetching artifacts used in CI or offline deployments.
Install from local artifacts without contacting indexes.
python -m pip install --no-index --find-links ./wheelhouse -r requirements.txtA common pattern for hermetic or air-gapped builds.
python -m pip install --no-deps ./dist/my_package.whlHelpful when dependencies are preinstalled or controlled separately.
Apply version constraints to a direct install.
python -m pip install pandas -c constraints.txtLets you pin transitive versions while still installing by name.
Example pattern for base + dev requirement layering.
# requirements-dev.txt
-r requirements.txt
pytest
black
ruffA clean way to maintain development-only tooling on top of runtime dependencies.
urllib3==2.2.2
charset-normalizer==3.3.2
idna==3.7Constraints files do not declare top-level packages; they only restrict versions.
Write a structured report during installation.
python -m pip install -r requirements.txt --report pip-report.jsonUseful in build systems that need machine-readable dependency information.
python -m pip freeze | sort > requirements.lock.txtSorting makes diffs easier to review in version control.
python -m pip list --format=jsonUseful for automation, audits, and environment checks.