Managing Dependencies

Metax-service uses Poetry for managing Python dependencies securely. Poetry generates very strict requirements.txt files, while enabling easy update of minor security and bug patches from pip with pyproject.toml defined version constraints. Generated requirements.txt is guaranteed to lock all dependencies and sub-dependencies. Poetry file poetry.lock stores hashes of all dependencies, if the integrity of the dependency-tree ever needs to be verified.

For full documentation of Poetry, visit the official documentation

Installing Poetry

First, install pipx. Pipx is a system-wide Python application installer, that creates virtualenv for every package installed and automatically includes them to path. It can also uninstall any package installed using pipx. With pipx installed, install Poetry with pipx install poetry. After installation, you will have poetry available system-wide.

Updating dependencies

Add development dependencies

poetry add -D <package>

Add application dependencies

poetry add <package>

Update all dependencies

poetry update

Remove dependencies

poetry remove (-D) <package>

Re-generate requirements

After any modification to pyproject.toml, re-generate requirements with

poetry export --without-hashes -o requirements.txt

and

poetry export --dev --without-hashes -o dev-requirements.txt