35:"/_next/static/chunks/0_6qdgbl18thf.js" 36:"/_next/static/chunks/3316o_1ddm9ab.js" 37:I[96601,["$1","$22","$23","$35","$36"],"default"] 38:I[58709,["$1","$22","$23","$35","$36"],"default"] 39:I[80423,["$1","$22","$23","$35","$36"],"default"] 3a:T6ba,# Safety is another popular security scanner $ pip install safety # Scan current environment $ safety check +==============================================================================+ | | | /$$$$$$ /$$ | | /$$__ $$ | $$ | | | $$ \__/ /$$$$$$ | $$$$$$ /$$$$$$ /$$$$$$ /$$ /$$ | | | $$$$$$ |____ $$| $$__ $$ /$$__ $$ |____ $$| $$ | $$ | | \____ $$ /$$$$$$$| $$ \ $$| $$$$$$$$ /$$$$$$$| $$ | $$ | | /$$ \ $$ /$$__ $$| $$ | $$| $$_____/ /$$__ $$| $$ | $$ | | | $$$$$$/| $$$$$$$| $$ | $$| $$$$$$$| $$$$$$$| $$$$$$$ | | \______/ \_______/|__/ |__/ \_______/ \_______/ \____ $$ | | /$$ | $$ | | | $$$$$$/ | | by pyup.io \______/ | | | +==============================================================================+ 2 vulnerabilities found: -> Vulnerability found in requests version 2.28.0 ID: 51668 Fix: Upgrade to 2.31.0 # Scan requirements file $ safety check -r requirements.txt # Ignore specific vulnerabilities (if false positive) $ safety check --ignore 51668 # CI/CD integration $ safety check --json > safety-report.json $ safety check --exit-code # Fail build if issues found3b:T42d,# .github/workflows/security.yml name: Security Scan on: push: branches: [ main, develop ] pull_request: branches: [ main ] schedule: # Run weekly on Monday at 9 AM - cron: '0 9 * * 1' jobs: security: runs-on: ubuntu-latest steps: - uses: actions/checkout@v3 - name: Set up Python uses: actions/setup-python@v4 with: python-version: '3.11' - name: Install dependencies run: | pip install pip-audit safety pip install -r requirements.txt - name: Run pip-audit run: pip-audit --strict - name: Run safety check run: safety check --json --output safety-report.json - name: Upload security report if: always() uses: actions/upload-artifact@v3 with: name: security-report path: safety-report.json # This runs on: # ✓ Every push to main/develop # ✓ Every pull request # ✓ Weekly schedule (catch new CVEs) # Prevents merging code with vulnerabilities3c:T419,# Install pipdeptree $ pip install pipdeptree # Show dependency tree $ pipdeptree Flask==2.3.3 - click [required: >=8.0, installed: 8.1.7] - itsdangerous [required: >=2.0, installed: 2.1.2] - Jinja2 [required: >=3.0, installed: 3.1.2] - MarkupSafe [required: >=2.0, installed: 2.1.3] - Werkzeug [required: >=2.3.7, installed: 2.3.7] requests==2.31.0 - certifi [required: >=2017.4.17, installed: 2023.7.22] - charset-normalizer [required: >=2,<4, installed: 3.2.0] - idna [required: >=2.5,<4, installed: 3.4] - urllib3 [required: >=1.21.1,<3, installed: 2.0.4] # Find conflicts $ pipdeptree --warn Warning!!! Possibly conflicting dependencies found: * package-a==1.0.0 - library-x [required: <2.0, installed: 1.5.0] * package-b==2.0.0 - library-x [required: >=2.0, installed: 1.5.0] # Show reversed tree (what depends on this package) $ pipdeptree --reverse --packages Werkzeug Werkzeug==2.3.7 - Flask==2.3.3 [requires: Werkzeug>=2.3.7] # Generate JSON for programmatic analysis $ pipdeptree --json > dependencies.json3d:T184e,# Setup script for requirements.txt exercise #!/usr/bin/env python3 """ Requirements File Creation Exercise Projects to set up: 1. Flask Web App - Simple REST API 2. Data Analysis - pandas + matplotlib script 3. Automation Tool - requests + beautifulsoup web scraper """ import os import subprocess import sys from pathlib import Path def create_project_structure(project_name: str, project_type: str): """Create project directory with basic structure""" project_dir = Path(project_name) project_dir.mkdir(exist_ok=True) # Create main file based on type if project_type == 'flask': main_file = project_dir / 'app.py' main_file.write_text(""" from flask import Flask, jsonify app = Flask(__name__) @app.route('/') def home(): return jsonify({'message': 'Hello World'}) if __name__ == '__main__': app.run(debug=True) """) dependencies = ['flask', 'python-dotenv'] elif project_type == 'data': main_file = project_dir / 'analyze.py' main_file.write_text(""" import pandas as pd import matplotlib.pyplot as plt # Sample data analysis df = pd.DataFrame({'x': range(10), 'y': range(10)}) print(df.describe()) """) dependencies = ['pandas', 'matplotlib', 'numpy'] elif project_type == 'scraper': main_file = project_dir / 'scraper.py' main_file.write_text(""" import requests from bs4 import BeautifulSoup url = 'https://example.com' response = requests.get(url) soup = BeautifulSoup(response.content, 'html.parser') print(soup.title.text) """) dependencies = ['requests', 'beautifulsoup4', 'lxml'] return project_dir, dependencies def setup_project_environment(project_dir: Path, dependencies: list[str]): """Create venv and install dependencies""" print(f'\n=== Setting up {project_dir.name} ===') # TODO: Create virtual environment # subprocess.run([sys.executable, '-m', 'venv', project_dir / 'venv']) # TODO: Determine activation script based on OS # Windows: venv\Scripts\activate.bat # Unix: source venv/bin/activate # TODO: Install dependencies # for dep in dependencies: # subprocess.run(['pip', 'install', dep]) # TODO: Generate requirements.txt # subprocess.run(['pip', 'freeze', '>', 'requirements.txt']) pass def add_requirements_header(requirements_file: Path, python_version: str, project_desc: str): """Add informative header to requirements.txt""" header = f""" # {project_desc} # Python Version: {python_version} # Last Updated: {datetime.now().strftime('%Y-%m-%d')} # # Installation: # python -m venv venv # source venv/bin/activate # On Windows: venv\Scripts\activate # pip install -r requirements.txt # """ # TODO: Prepend header to existing requirements.txt pass def create_gitignore(project_dir: Path): """Create .gitignore for Python project""" gitignore_content = """ # Virtual Environment venv/ env/ ENV/ # Python __pycache__/ *.py[cod] *$py.class *.so # Environment variables .env .env.local # IDE .vscode/ .idea/ *.swp # OS .DS_Store Thumbs.db """ # TODO: Write to .gitignore pass def test_requirements_recreation(project_dir: Path): """Verify requirements.txt can recreate environment""" print(f'\n=== Testing {project_dir.name} requirements.txt ===') # TODO: Delete venv directory # TODO: Create fresh venv # TODO: Run 'pip install -r requirements.txt' # TODO: Verify project runs: python app.py or python analyze.py # TODO: Report success/failure pass def compare_requirements(project_dirs: list[Path]): """Compare requirements across projects""" print('\n=== Comparing Requirements Across Projects ===') all_packages = {} for project in project_dirs: req_file = project / 'requirements.txt' # TODO: Parse requirements.txt # TODO: Extract package names and versions # TODO: Store in all_packages dict # TODO: Generate comparison table: # | Package | Project 1 | Project 2 | Project 3 | Notes | # |------------|-----------|-----------|-----------|--------------------| # | flask | 2.3.0 | - | - | Web framework | # | pandas | - | 2.0.0 | - | Data analysis | # | requests | 2.31.0 | 2.31.0 | 2.31.0 | Common dependency | # TODO: Write to requirements-comparison.md pass def create_readme(project_dir: Path, project_desc: str): """Create README with setup instructions""" readme = f""" # {project_dir.name} {project_desc} ## Setup ### Prerequisites - Python 3.11+ - pip ### Installation 1. Clone the repository 2. Create virtual environment: ```bash python -m venv venv ``` 3. Activate virtual environment: - Windows: `venv\\Scripts\\activate` - Mac/Linux: `source venv/bin/activate` 4. Install dependencies: ```bash pip install -r requirements.txt ``` ## Usage ```bash python app.py # or appropriate main file ``` ## Dependencies See `requirements.txt` for complete list. Main dependencies: - [List key packages and their purpose] """ # TODO: Write to README.md pass if __name__ == '__main__': # Create 3 sample projects projects = [ ('flask-api', 'flask', 'Simple REST API with Flask'), ('data-analysis', 'data', 'Data analysis with pandas'), ('web-scraper', 'scraper', 'Web scraping tool') ] project_dirs = [] for name, ptype, desc in projects: project_dir, deps = create_project_structure(name, ptype) setup_project_environment(project_dir, deps) add_requirements_header(project_dir / 'requirements.txt', sys.version, desc) create_gitignore(project_dir) create_readme(project_dir, desc) test_requirements_recreation(project_dir) project_dirs.append(project_dir) compare_requirements(project_dirs) print('\n✅ Exercise complete!') print('You now have 3 projects with proper requirements.txt') print('Practice: Share one project with friend, have them set up from requirements.txt')3e:T12eb,# Flask REST API with Separated Dependencies # === app.py === from flask import Flask, jsonify, request from typing import List, Dict import os app = Flask(__name__) app.config['SECRET_KEY'] = os.getenv('SECRET_KEY', 'dev-secret-key') # In-memory database for demo users: List[Dict] = [ {'id': 1, 'name': 'Alice', 'email': 'alice@example.com'}, {'id': 2, 'name': 'Bob', 'email': 'bob@example.com'}, ] @app.route('/health', methods=['GET']) def health(): """Health check endpoint""" return jsonify({'status': 'healthy', 'version': '1.0.0'}) @app.route('/api/users', methods=['GET']) def get_users(): """Get all users""" return jsonify({'users': users}) @app.route('/api/users/', methods=['GET']) def get_user(user_id: int): """Get user by ID""" user = next((u for u in users if u['id'] == user_id), None) if not user: return jsonify({'error': 'User not found'}), 404 return jsonify({'user': user}) @app.route('/api/users', methods=['POST']) def create_user(): """Create new user""" data = request.get_json() # TODO: Add validation new_user = { 'id': max(u['id'] for u in users) + 1, 'name': data['name'], 'email': data['email'] } users.append(new_user) return jsonify({'user': new_user}), 201 # TODO: Add PUT and DELETE endpoints if __name__ == '__main__': app.run(debug=True) # === requirements.txt (PRODUCTION) === # Production dependencies only - minimal for deployment # Python 3.11+ # Last updated: 2024-12-17 Flask==3.0.0 gunicorn==21.2.0 # Production WSGI server python-dotenv==1.0.0 # Environment variable management # === requirements-dev.txt (DEVELOPMENT) === # Development dependencies - includes production + dev tools # Install: pip install -r requirements-dev.txt -r requirements.txt # Include all production dependencies # Testing pytest==7.4.3 pytest-flask==1.3.0 # Code Quality black==23.12.0 # Code formatter flake8==6.1.0 # Linter mypy==1.7.0 # Type checker # Development Tools ipython==8.18.0 # Better REPL ipdb==0.13.13 # Debugger # === requirements-test.txt (TESTING/CI) === # Testing dependencies - includes dev + additional test tools # Install: pip install -r requirements-test.txt -r requirements-dev.txt # Include all dev dependencies # Test Coverage pytest-cov==4.1.0 coverage[toml]==7.3.2 # Mocking and Fixtures pytest-mock==3.12.0 responses==0.24.0 # HTTP mocking faker==21.0.0 # Test data generation # === Makefile === .PHONY: install-prod install-dev install-test test lint format install-prod: @echo "Installing production dependencies..." pip install -r requirements.txt install-dev: @echo "Installing development dependencies..." pip install -r requirements-dev.txt install-test: @echo "Installing test dependencies..." pip install -r requirements-test.txt test: @echo "Running tests with coverage..." pytest --cov=app --cov-report=html --cov-report=term lint: @echo "Running linters..." flake8 app.py tests/ mypy app.py format: @echo "Formatting code..." black app.py tests/ # === pytest.ini === [pytest] testpaths = tests python_files = test_*.py python_classes = Test* python_functions = test_* addopts = --cov=app --cov-report=html --cov-report=term-missing --cov-fail-under=80 -v # === Dockerfile (PRODUCTION) === FROM python:3.11-slim WORKDIR /app # Copy only production requirements COPY requirements.txt . # Install production dependencies only RUN pip install --no-cache-dir -r requirements.txt # Copy application code COPY app.py . EXPOSE 8000 # Use gunicorn in production CMD ["gunicorn", "--bind", "0.0.0.0:8000", "app:app"] # === .env.example === # Copy to .env and fill in values # NEVER commit .env to Git! SECRET_KEY=your-secret-key-here DATABASE_URL=postgresql://user:pass@localhost/dbname FLASK_ENV=production LOG_LEVEL=INFO # === tests/test_app.py === import pytest from app import app from faker import Faker fake = Faker() @pytest.fixture def client(): """Flask test client fixture""" app.config['TESTING'] = True with app.test_client() as client: yield client def test_health_check(client): """Test health endpoint returns 200""" response = client.get('/health') assert response.status_code == 200 assert response.json['status'] == 'healthy' def test_get_users(client): """Test getting all users""" # TODO: Implement test pass def test_create_user(client): """Test creating new user with faker data""" new_user = { 'name': fake.name(), 'email': fake.email() } # TODO: POST to /api/users # TODO: Assert 201 created # TODO: Assert user in response pass # TODO: Add more tests for all endpoints # TODO: Test error cases (404, 400, etc.) # TODO: Test with pytest-mock for external dependencies3f:T49d,Professional dependency management demonstrating production-grade practices. Three-tier dependency structure: requirements.txt (production essentials ~5 packages), requirements-dev.txt (+ development tools ~15 packages), requirements-test.txt (+ testing libraries ~20 packages). Clear understanding of why separation matters: production Docker image is 50% smaller (100MB vs 200MB), deploys 2x faster, has fewer security vulnerabilities (no test dependencies to exploit), costs less to run (smaller images = less bandwidth/storage). Makefile automation: developers run 'make install-dev' once, CI/CD runs 'make install-test', production deployment uses 'make install-prod' - no confusion about which requirements file. Professional practices: .env.example documents required variables, pytest.ini configures coverage thresholds, Dockerfile uses minimal production requirements, tests use faker for realistic data. Recognition that this pattern scales: whether 10 packages or 100, whether solo project or enterprise application, separating dependencies reduces costs and increases security. Essential for real-world development where production efficiency and security are critical.40:T290c,# Security Scanning and Remediation #!/usr/bin/env python3 """ Security Vulnerability Scanning and Remediation Tools: - pip-audit: Official PyPI vulnerability scanner (recommended) - safety: Commercial vulnerability database (free tier available) - bandit: Finds security issues in Python code Workflow: 1. Scan dependencies for vulnerabilities 2. Document findings with severity levels 3. Update packages to secure versions 4. Test that updates don't break functionality 5. Automate scanning in CI/CD """ import subprocess import json from datetime import datetime from pathlib import Path from typing import List, Dict def install_security_tools(): """Install pip-audit, safety, and bandit""" print('Installing security scanning tools...') tools = ['pip-audit', 'safety', 'bandit'] for tool in tools: subprocess.run(['pip', 'install', tool], check=True) print('✓ Security tools installed\n') def run_pip_audit() -> List[Dict]: """Run pip-audit and parse results""" print('=== Running pip-audit ===') # Run pip-audit with JSON output result = subprocess.run( ['pip-audit', '--format', 'json'], capture_output=True, text=True ) if result.returncode == 0: print('✓ No vulnerabilities found by pip-audit') return [] # Parse JSON output try: vulnerabilities = json.loads(result.stdout) print(f'⚠️ Found {len(vulnerabilities)} vulnerabilities') for vuln in vulnerabilities: print(f"\n Package: {vuln['name']} {vuln['version']}") print(f" Vulnerability: {vuln['id']} ({vuln['severity']})") print(f" Fixed in: {vuln['fix_versions']}") print(f" Details: {vuln['description'][:100]}...") return vulnerabilities except json.JSONDecodeError: print('Error parsing pip-audit output') return [] def run_safety_check() -> Dict: """Run safety check and parse results""" print('\n=== Running safety check ===') # Safety check with JSON output result = subprocess.run( ['safety', 'check', '--json'], capture_output=True, text=True ) # TODO: Parse safety JSON output # TODO: Compare with pip-audit results # TODO: Identify unique vulnerabilities from each tool pass def run_bandit_scan(): """Scan Python code for security issues""" print('\n=== Running bandit code security scan ===') # Scan all Python files result = subprocess.run( ['bandit', '-r', '.', '-f', 'json', '-o', 'bandit-report.json'], capture_output=True ) # TODO: Parse bandit output # TODO: Report HIGH and MEDIUM severity issues # TODO: Check for: # - Hardcoded passwords/secrets # - SQL injection vulnerabilities # - Weak cryptographic functions # - Insecure random number generation pass def generate_security_audit_report(pip_audit_vulns: List[Dict], safety_vulns: Dict): """Generate comprehensive security audit report""" report = f""" # Security Audit Report **Date:** {datetime.now().strftime('%Y-%m-%d %H:%M')} **Tools:** pip-audit, safety, bandit ## Executive Summary - **Total Vulnerabilities Found:** {len(pip_audit_vulns)} - **Critical:** {sum(1 for v in pip_audit_vulns if v.get('severity') == 'CRITICAL')} - **High:** {sum(1 for v in pip_audit_vulns if v.get('severity') == 'HIGH')} - **Medium:** {sum(1 for v in pip_audit_vulns if v.get('severity') == 'MEDIUM')} ## Detailed Findings """ # TODO: Add detailed vulnerability information: # For each vulnerability: # - Package name and current version # - CVE ID and CVSS score # - Severity level with color coding # - Vulnerability description # - Affected versions # - Fixed version recommendation # - Exploit details and CVSS vector # - Remediation steps # TODO: Add priority ranking: # 1. CRITICAL vulnerabilities with known exploits # 2. HIGH vulnerabilities in production dependencies # 3. MEDIUM vulnerabilities with updates available # TODO: Write to SECURITY_AUDIT.md pass def update_vulnerable_package(package: str, current_version: str, fixed_version: str): """Update package to secure version and test""" print(f'\nUpdating {package} from {current_version} to {fixed_version}...') # Update package subprocess.run(['pip', 'install', f'{package}=={fixed_version}'], check=True) # Run tests to verify no breaking changes print('Running tests...') result = subprocess.run(['pytest'], capture_output=True) if result.returncode == 0: print(f'✓ {package} updated successfully, all tests pass') return True else: print(f'✗ Tests failed after updating {package}') print('Rolling back...') subprocess.run(['pip', 'install', f'{package}=={current_version}']) return False def create_github_action_security_scan(): """Create GitHub Action for automated security scanning""" github_action = """ name: Security Scan on: pull_request: branches: [main] schedule: - cron: '0 0 * * 1' # Weekly on Monday workflow_dispatch: # Manual trigger jobs: security-scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v3 - name: Set up Python uses: actions/setup-python@v4 with: python-version: '3.11' - name: Install dependencies run: | python -m pip install --upgrade pip pip install -r requirements.txt pip install pip-audit safety - name: Run pip-audit run: | pip-audit --desc --format json continue-on-error: false # Fail build on vulnerabilities - name: Run safety check run: | safety check --json continue-on-error: true # Don't fail on safety (more false positives) - name: Run bandit security scan run: | pip install bandit bandit -r . -f json -o bandit-report.json - name: Upload security reports uses: actions/upload-artifact@v3 if: always() with: name: security-reports path: | pip-audit-report.json safety-report.json bandit-report.json - name: Fail on HIGH/CRITICAL vulnerabilities run: | # Check if pip-audit found HIGH or CRITICAL vulnerabilities # Exit 1 to fail the workflow if pip-audit --desc | grep -E 'HIGH|CRITICAL'; then echo "HIGH or CRITICAL vulnerabilities found!" exit 1 fi """ # TODO: Write to .github/workflows/security-scan.yml # TODO: Create .github directory if not exists pass def create_dependabot_config(): """Configure Dependabot for automated security updates""" dependabot_config = """ version: 2 updates: - package-ecosystem: "pip" directory: "/" schedule: interval: "weekly" day: "monday" open-pull-requests-limit: 10 # Only create PRs for security updates open-pull-requests-limit: 5 # Grouping updates groups: production-dependencies: patterns: - "flask*" - "gunicorn*" development-dependencies: patterns: - "pytest*" - "black*" # Ignore specific updates if needed ignore: - dependency-name: "some-package" versions: ["1.x", "2.x"] """ # TODO: Write to .github/dependabot.yml pass def create_security_policy(): """Create SECURITY.md documenting security update workflow""" security_policy = """ # Security Policy ## Supported Versions We actively maintain security updates for: | Version | Supported | | ------- | ------------------ | | 1.x | :white_check_mark: | | < 1.0 | :x: | ## Reporting a Vulnerability If you discover a security vulnerability, please email security@example.com. Do NOT create a public issue. ## Security Update Workflow ### Automated Scanning 1. **pip-audit**: Runs on every PR and weekly 2. **Dependabot**: Creates PRs for vulnerable dependencies 3. **Bandit**: Scans code for security issues ### Manual Security Updates 1. Review vulnerability alert (GitHub Security, pip-audit) 2. Check severity: CRITICAL/HIGH requires immediate action 3. Update to fixed version: `pip install package==x.y.z` 4. Run full test suite: `pytest` 5. Manual testing for critical paths 6. Update requirements.txt: `pip freeze > requirements.txt` 7. Create PR with security tag 8. Merge and deploy immediately for CRITICAL ### Priority Levels - **CRITICAL**: Immediate update required (same day) - **HIGH**: Update within 7 days - **MEDIUM**: Update within 30 days - **LOW**: Update during regular maintenance ### Testing Requirements - All automated tests must pass - Manual testing for authentication/authorization changes - Load testing for performance-critical updates - Rollback plan documented ## Security Best Practices 1. Never commit secrets to Git (.env in .gitignore) 2. Use environment variables for credentials 3. Pin dependency versions in requirements.txt 4. Regular security audits (monthly pip-audit) 5. Keep dependencies updated (weekly Dependabot) 6. Review dependency PRs carefully (supply chain attacks) """ # TODO: Write to SECURITY.md pass if __name__ == '__main__': print('Python Dependency Security Scanner\n') # Install tools install_security_tools() # Run scans pip_audit_vulns = run_pip_audit() safety_vulns = run_safety_check() run_bandit_scan() # Generate report generate_security_audit_report(pip_audit_vulns, safety_vulns) # Update vulnerable packages for vuln in pip_audit_vulns: if vuln.get('severity') in ['CRITICAL', 'HIGH']: update_vulnerable_package( vuln['name'], vuln['version'], vuln['fix_versions'][0] ) # Set up automation create_github_action_security_scan() create_dependabot_config() create_security_policy() print('\n✅ Security audit complete!') print('Review SECURITY_AUDIT.md for detailed findings') print('GitHub Actions and Dependabot configured for continuous monitoring')41:T53e,Complete security vulnerability management system for Python dependencies. Mastery of security scanning: pip-audit identifies CVE vulnerabilities, safety provides additional coverage, bandit finds code security issues (hardcoded secrets, SQL injection). Professional vulnerability assessment: understanding severity levels (CRITICAL requires same-day fix, HIGH within week, MEDIUM within month), reading CVE reports, evaluating exploit likelihood. Systematic remediation: updating packages to secure versions, testing for breaking changes, documenting updates in audit report. Automated security: GitHub Action scanning every PR and weekly, Dependabot creating PRs for vulnerable packages, workflow fails on HIGH/CRITICAL preventing vulnerable code from merging. Recognition that security is continuous process, not one-time audit: new vulnerabilities discovered daily (log4j, requests, pillow all had recent HIGH/CRITICAL CVEs). Professional documentation: SECURITY.md explaining team workflow, SECURITY_AUDIT.md recording findings and remediation. Essential skill for production applications: data breaches from known vulnerabilities cost companies millions, cause regulatory fines (GDPR), destroy reputation. This demonstrates senior responsibility: you don't just write code that works, you ensure code is secure throughout its lifecycle.29:["$","div",null,{"className":"min-h-screen bg-gray-50 dark:bg-gray-900 pt-20","children":[["$","$L37",null,{"topicSlug":"python","topicTitle":"Python Engineer's Expedition","dayNumber":60,"dayTitle":"Requirements Files and Dependency Management","sprintNumber":3,"estimatedTime":"4 hours","totalDays":66}],["$","div",null,{"className":"w-full px-4 sm:px-6 lg:px-8 py-8","children":["$","$L38",null,{"dayNumber":60,"topicSlug":"python","children":["$","$L39",null,{"day":{"sprintNumber":3,"dayNumber":60,"title":"Requirements Files and Dependency Management","subtitle":"Master reproducible environments with requirements.txt","description":"Master requirements.txt, pip freeze, dependency pinning, and version management. Learn development vs production dependencies, security scanning, and reproducible environments for team collaboration and deployment.","learningGoals":[{"id":"goal-60-1","text":"Understand why requirements.txt is essential for reproducible environments","measurable":"Explain dependency drift problems and demonstrate pip freeze workflow"},{"id":"goal-60-2","text":"Create and manage requirements.txt with pip freeze","measurable":"Generate requirements.txt for 3+ projects and recreate exact environments from them"},{"id":"goal-60-3","text":"Master version specifiers: ==, >=, ~=, compatible releases","measurable":"Write requirements with appropriate version pins and understand semantic versioning"},{"id":"goal-60-4","text":"Separate development and production dependencies","measurable":"Create requirements.txt, requirements-dev.txt, and requirements-test.txt structure"},{"id":"goal-60-5","text":"Scan dependencies for security vulnerabilities","measurable":"Use pip-audit and safety to identify and fix vulnerable packages"},{"id":"goal-60-6","text":"Handle dependency conflicts and resolution","measurable":"Use pip check to identify conflicts and resolve using pipdeptree"}],"whyThisMatters":{"productionStory":"At Netflix, engineers deploy 4,000+ times per day. Each deployment must have exact same dependencies as tested in CI/CD. Without pinned requirements.txt, production gets numpy 1.24 while development used 1.23—subtle bugs appear. Requirements.txt ensures: same versions locally, in CI, in staging, in production. 'pip install -r requirements.txt' creates identical environment every time. This reproducibility is foundation of reliable deployments.","realWorldContext":"You clone teammate's repository. Run 'python app.py'. Error: 'No module named requests'. Without requirements.txt, you guess dependencies. With it: 'pip install -r requirements.txt' installs everything automatically. Six months later, return to project—same dependencies work. Requirements.txt is project memory: exactly what packages at exactly what versions.","industryRelevance":"Job interview question: 'How do you manage Python dependencies?' Wrong answer: 'pip install whatever I need.' Right answer: 'Virtual environment with requirements.txt pinned to specific versions, separate dev dependencies, security scanning with pip-audit.' Every Python team expects this. No requirements.txt = unprofessional project."},"missionAlignment":{"empowerLearners":"Requirements.txt unlocks collaboration. Share project with anyone, they run one command and have working environment. Deploy to any server with confidence—same versions always work.","expertiseInFocus":"You'll learn professional workflow: venv + requirements.txt for simple projects, Poetry for complex dependency trees. Know when to pin exact versions (==) vs allow updates (~=).","realWorldPreparation":"First day at job: clone repo, create venv, 'pip install -r requirements.txt', run tests. This workflow is universal. You'll be productive immediately."},"coreValues":{"practiceFirst":"Create requirements.txt for 5+ projects. Practice dependency conflicts, security scanning, version resolution.","masteryOriented":"Understand pip's dependency resolver, why version conflicts happen, how semantic versioning works.","buildInPublic":"Your GitHub projects will have proper requirements.txt—visitors can run your code instantly."},"topics":["requirements.txt basics","pip freeze workflow","Version specifiers","Development dependencies","Security scanning","Dependency conflicts"],"coreContent":{"sections":[{"id":"section-1","type":"concept","title":"Why Requirements Files Matter","order":1,"content":{"explanation":"Requirements.txt solves the reproducibility problem: code works on your machine, breaks on server because different package versions. Requirements files document exact dependencies and versions, enabling anyone to recreate your environment. This is professional standard across all Python teams.","codeExamples":[{"title":"The Problem: Dependency Drift","code":"# Monday: You develop app\npip install requests\n# Gets requests 2.31.0 (latest)\n\n# Your code:\nimport requests\nresponse = requests.get('https://api.example.com')\n# Works perfectly!\n\n# Friday: Teammate clones repo\npip install requests\n# Gets requests 2.32.0 (new release with breaking changes)\n\n# Same code, different behavior:\nimport requests\nresponse = requests.get('https://api.example.com')\n# Error: requests.exceptions.SSLError\n# requests 2.32 changed SSL verification behavior\n\n# Problem: No version control of dependencies\n# Solution: requirements.txt with pinned versions","language":"python","explanation":"Without requirements.txt, everyone gets whatever version is latest when they install. Code breaks months later when dependencies update."},{"title":"The Solution: requirements.txt","code":"# requirements.txt\nrequests==2.31.0\nflask==2.3.3\nsqlalchemy==2.0.20\npython-dotenv==1.0.0\n\n# Install exact versions:\n$ pip install -r requirements.txt\n\n# Benefits:\n# ✓ Everyone gets same versions\n# ✓ Production matches development\n# ✓ Code works 6 months later\n# ✓ CI/CD uses identical dependencies\n# ✓ Docker containers reproduce exactly\n\n# Creating requirements.txt:\n$ pip freeze > requirements.txt\n\n# This captures ALL installed packages with exact versions\n# pip freeze outputs:\n# package-name==exact.version.number","language":"bash","explanation":"requirements.txt pins exact versions. Everyone who runs 'pip install -r requirements.txt' gets identical environment."},{"title":"Real-World Impact: Production Deployment","code":"# Without requirements.txt:\n# Local dev: numpy 1.24.3 (installed 2 months ago)\n# Production: numpy 1.25.0 (installed today)\n# Result: Subtle numerical differences break ML model\n\n# With requirements.txt:\n# requirements.txt\nnumpy==1.24.3\npandas==2.0.3\nscikit-learn==1.3.0\n\n# Deployment script:\n$ python -m venv venv\n$ source venv/bin/activate\n$ pip install -r requirements.txt\n$ python app.py\n\n# Result: Identical environment everywhere\n# Local, CI, Staging, Production all use numpy 1.24.3\n# Model produces consistent results\n\n# This is why Netflix deploys 4000+ times/day safely","language":"bash","explanation":"Requirements.txt ensures production has exact same dependencies as development. No surprises, no 'works on my machine' issues."}]}},{"id":"section-2","type":"concept","title":"Creating and Managing Requirements Files","order":2,"content":{"explanation":"Workflow: develop in virtual environment, install packages, use pip freeze to capture dependencies. For production, create clean requirements.txt with only direct dependencies. For development, include testing/linting tools.","codeExamples":[{"title":"Complete Workflow: From Project Start to requirements.txt","code":"# Step 1: Create virtual environment\n$ python -m venv venv\n$ source venv/bin/activate # On Windows: venv\\Scripts\\activate\n\n# Step 2: Install packages as you develop\n$ pip install flask\n$ pip install requests\n$ pip install sqlalchemy\n$ pip install python-dotenv\n\n# Step 3: Create requirements.txt\n$ pip freeze > requirements.txt\n\n# View requirements.txt:\n$ cat requirements.txt\nblinker==1.6.2\nclick==8.1.7\nFlask==2.3.3\nitsdangerous==2.1.2\nJinja2==3.1.2\nMarkupSafe==2.1.3\nrequests==2.31.0\ncertifi==2023.7.22\ncharset-normalizer==3.2.0\nidna==3.4\nurllib3==2.0.4\nSQLAlchemy==2.0.20\ntyping-extensions==4.7.1\npython-dotenv==1.0.0\n\n# Note: pip freeze includes ALL dependencies\n# Flask needs Jinja2, click, etc - all captured\n\n# Step 4: Test on fresh environment\n$ deactivate\n$ rm -rf venv\n$ python -m venv venv\n$ source venv/bin/activate\n$ pip install -r requirements.txt\n$ python app.py # Should work identically!","language":"bash","explanation":"This workflow ensures requirements.txt captures complete dependency tree. Anyone can recreate your environment exactly."},{"title":"Clean Requirements: Direct Dependencies Only","code":"# Problem: pip freeze captures EVERYTHING\n# Including sub-dependencies you don't care about\n\n# pip freeze output (messy):\nblinker==1.6.2 # Flask dependency\nclick==8.1.7 # Flask dependency\nFlask==2.3.3 # What you installed\nJinja2==3.1.2 # Flask dependency\nrequests==2.31.0 # What you installed\n... 20+ packages\n\n# Clean requirements.txt (better):\n# requirements.txt - only direct dependencies\nFlask==2.3.3\nrequests==2.31.0\nSQLAlchemy==2.0.20\npython-dotenv==1.0.0\n\n# pip will automatically install sub-dependencies\n# Cleaner, easier to maintain\n\n# How to create clean requirements.txt:\n# Option 1: Manual (track what YOU install)\n$ echo \"Flask==2.3.3\" >> requirements.txt\n$ echo \"requests==2.31.0\" >> requirements.txt\n\n# Option 2: Use pip-tools (advanced)\n$ pip install pip-tools\n# Create requirements.in (direct deps only):\nFlask\nrequests\n# Generate requirements.txt with all deps:\n$ pip-compile requirements.in","language":"bash","explanation":"Clean requirements.txt only lists packages you explicitly need. pip installs their dependencies automatically."},{"title":"Updating Requirements","code":"# Current requirements.txt\nrequests==2.28.0\n\n# Security advisory: requests 2.28 has vulnerability\n# Need to update to 2.31.0\n\n# Step 1: Update in virtual environment\n$ pip install --upgrade requests\n\n# Step 2: Update requirements.txt\n$ pip freeze | grep requests\nrequests==2.31.0\n\n# Step 3: Update requirements.txt manually\n# Or regenerate:\n$ pip freeze > requirements.txt\n\n# Testing workflow:\n$ pip install -r requirements.txt\n$ python -m pytest # Run tests\n$ git add requirements.txt\n$ git commit -m \"chore: update requests 2.28.0 -> 2.31.0 (security fix)\"\n\n# Best practice: update one package at a time\n# Test after each update\n# Document why in commit message","language":"bash","explanation":"Update dependencies carefully: upgrade, test, update requirements.txt, commit. One package at a time minimizes risk."}]}},{"id":"section-3","type":"concept","title":"Version Specifiers and Semantic Versioning","order":3,"content":{"explanation":"Version specifiers control what versions pip can install. == pins exact version (safest). >= allows any newer version (riskiest). ~= allows patch updates (balanced). Understand semantic versioning (MAJOR.MINOR.PATCH) to choose right specifier.","codeExamples":[{"title":"Semantic Versioning (SemVer) Explained","code":"# Package version: MAJOR.MINOR.PATCH\n# Example: requests==2.31.0\n# 2 = MAJOR\n# 31 = MINOR \n# 0 = PATCH\n\n# Semantic versioning rules:\n# MAJOR: Breaking changes (API changes, backwards incompatible)\n# MINOR: New features (backwards compatible)\n# PATCH: Bug fixes (backwards compatible)\n\n# Examples:\n# 1.0.0 -> 1.0.1: Patch (bug fix, safe to update)\n# 1.0.0 -> 1.1.0: Minor (new features, safe to update)\n# 1.0.0 -> 2.0.0: Major (breaking changes, review before update)\n\n# Real example - requests package:\n# 2.28.0 -> 2.28.1: Patch (bug fixes)\n# 2.28.0 -> 2.29.0: Minor (new features, keep compatibility)\n# 2.31.0 -> 3.0.0: Major (could break your code)\n\n# Why this matters:\n# Flask 2.x has different API than Flask 1.x\n# Code written for Flask 1.0 breaks on Flask 2.0\n# Must specify version carefully","language":"python","explanation":"Semantic versioning tells you impact of updates. MAJOR version changes can break your code. PATCH versions are usually safe."},{"title":"Version Specifiers: == vs >= vs ~= vs ^","code":"# Exact version (most strict)\nrequests==2.31.0\n# Only 2.31.0 allowed. Nothing else.\n# Safest but no security updates\n\n# Greater than or equal (most flexible)\nrequests>=2.31.0\n# 2.31.0, 2.31.1, 2.32.0, 3.0.0 all allowed\n# Dangerous: could get breaking changes\n\n# Compatible release (balanced)\nrequests~=2.31.0\n# Equivalent to >=2.31.0, <2.32.0\n# Allows: 2.31.0, 2.31.1, 2.31.2\n# Blocks: 2.32.0, 3.0.0\n# Best for production: get patches, avoid breaking changes\n\n# Caret (npm-style, uncommon in Python)\nrequests^2.31.0\n# Similar to ~= but follows npm rules\n# Not standard in Python\n\n# Multiple specifiers\nrequests>=2.28.0,<3.0.0\n# Any 2.x version, but not 3.x\n# Avoid major version breaking changes\n\n# Recommendation:\n# Development: ~= (get patches automatically)\n# Production: == (exact reproducibility)\n# Libraries: >=x.y.z,<(x+1).0.0 (compatibility range)","language":"text","explanation":"Version specifiers balance safety vs flexibility. == is safest, ~= allows patches, >= is dangerous in production."},{"title":"Real-World Version Specification","code":"# requirements.txt for production application\n\n# Web framework - exact version for stability\nFlask==2.3.3\n\n# Database - allow patches for security fixes\nSQLAlchemy~=2.0.20\npsycopg2-binary~=2.9.7\n\n# HTTP client - allow patches\nrequests~=2.31.0\n\n# Utilities - exact versions\npython-dotenv==1.0.0\nclick==8.1.7\n\n# Date/time - allow minor updates\npython-dateutil>=2.8.0,<3.0.0\n\n# Why these choices:\n# Flask: Core framework, exact version prevents surprises\n# SQLAlchemy: ~= gets security patches (2.0.21, 2.0.22 OK)\n# requests: ~= for security fixes\n# python-dateutil: >= for compatibility range\n\n# Don't do this in production:\nFlask>=2.0.0 # Might get Flask 3.0 with breaking changes!","language":"text","explanation":"Mix specifiers based on package role: exact for core frameworks, ~= for security-sensitive packages."}]}},{"id":"section-4","type":"concept","title":"Development vs Production Dependencies","order":4,"content":{"explanation":"Production needs minimal dependencies (app runs with fewer packages). Development needs testing tools, linters, debuggers. Separate into requirements.txt (production) and requirements-dev.txt (development). Deploy production requirements only—smaller, faster, more secure.","codeExamples":[{"title":"Separating Production and Development Dependencies","code":"# Project structure:\n# requirements.txt - production only\n# requirements-dev.txt - development tools\n# requirements-test.txt - testing tools\n\n# requirements.txt (production)\nFlask==2.3.3\nSQLAlchemy==2.0.20\nrequests==2.31.0\npython-dotenv==1.0.0\ngunicorn==21.2.0 # Production WSGI server\n\n# requirements-dev.txt (development)\n-r requirements.txt # Include production deps\npytest==7.4.0\npytest-cov==4.1.0\nblack==23.7.0 # Code formatter\nflake8==6.1.0 # Linter\nmypy==1.5.0 # Type checker\nipython==8.14.0 # Better REPL\nipdb==0.13.13 # Debugger\n\n# requirements-test.txt (CI/CD)\n-r requirements.txt\npytest==7.4.0\npytest-cov==4.1.0\npytest-mock==3.11.1\n\n# Install for development:\n$ pip install -r requirements-dev.txt\n\n# Install for production:\n$ pip install -r requirements.txt\n\n# Install for CI/CD:\n$ pip install -r requirements-test.txt","language":"bash","explanation":"Separate files for different environments. Production gets minimal dependencies. Development gets all tools."},{"title":"Why Separate Dependencies Matter","code":"# Without separation:\n# requirements.txt (mixed production + dev)\nFlask==2.3.3\nSQLAlchemy==2.0.20\nrequests==2.31.0\npytest==7.4.0 # Not needed in production!\nblack==23.7.0 # Not needed in production!\nflake8==6.1.0 # Not needed in production!\nmypy==1.5.0 # Not needed in production!\nipython==8.14.0 # Not needed in production!\n\n# Production deployment:\n$ pip install -r requirements.txt\n# Installs 50+ packages, only need 20\n# Slow deploy, larger Docker image, more attack surface\n\n# With separation:\n# requirements.txt (production only)\nFlask==2.3.3\nSQLAlchemy==2.0.20\nrequests==2.31.0\ngunicorn==21.2.0\n\n# Production deployment:\n$ pip install -r requirements.txt\n# Installs 20 packages\n# Fast deploy, small Docker image, minimal attack surface\n\n# Benefits:\n# ✓ Faster deployments (fewer packages)\n# ✓ Smaller Docker images (300MB vs 800MB)\n# ✓ Fewer security vulnerabilities\n# ✓ Clear separation of concerns","language":"bash","explanation":"Production only needs runtime dependencies. Development tools bloat production deployments and increase security risk."},{"title":"Docker Multi-Stage Build with Separated Requirements","code":"# Dockerfile\nFROM python:3.11-slim as base\n\n# Production stage\nFROM base as production\nWORKDIR /app\nCOPY requirements.txt .\nRUN pip install --no-cache-dir -r requirements.txt\nCOPY app/ .\nCMD [\"gunicorn\", \"app:app\"]\n\n# Development stage\nFROM base as development\nWORKDIR /app\nCOPY requirements-dev.txt .\nRUN pip install --no-cache-dir -r requirements-dev.txt\nCOPY . .\nCMD [\"flask\", \"run\", \"--debug\"]\n\n# Build for production:\n$ docker build --target production -t myapp:prod .\n# Image size: 150MB (only production deps)\n\n# Build for development:\n$ docker build --target development -t myapp:dev .\n# Image size: 350MB (includes pytest, black, etc)\n\n# Production deployment:\n$ docker run myapp:prod\n# Only production dependencies loaded\n# Faster startup, smaller memory footprint","language":"dockerfile","explanation":"Docker multi-stage builds use different requirements for production vs development. Production images are minimal."}]}},{"id":"section-5","type":"concept","title":"Security Scanning and Vulnerability Management","order":5,"content":{"explanation":"Dependencies can have security vulnerabilities. Tools like pip-audit and safety scan requirements.txt for known CVEs (Common Vulnerabilities and Exposures). Update vulnerable packages before deploying to production. Automate scanning in CI/CD pipeline.","codeExamples":[{"title":"Scanning for Vulnerabilities with pip-audit","code":"# Install pip-audit\n$ pip install pip-audit\n\n# Scan current environment\n$ pip-audit\n\nFound 2 vulnerabilities in 1 package\n\nName Version ID Fix Versions\n-------- ------- -------------- ------------\nrequests 2.28.0 PYSEC-2023-74 2.31.0\nrequests 2.28.0 GHSA-j8r2-6x86-q33q 2.31.0\n\n# Vulnerability details:\n# PYSEC-2023-74: SSL verification can be bypassed\n# GHSA-j8r2-6x86-q33q: Proxy-Authorization header leak\n\n# Fix: Update to safe version\n$ pip install --upgrade requests==2.31.0\n$ pip freeze > requirements.txt\n\n# Scan requirements.txt file\n$ pip-audit -r requirements.txt\n\n# Generate JSON report\n$ pip-audit --format json > security-report.json\n\n# Use in CI/CD:\n$ pip-audit --strict # Exit code 1 if vulnerabilities found\n# Prevents deployment if security issues exist","language":"bash","explanation":"pip-audit scans for known vulnerabilities. Update packages with security issues before deploying to production."},{"title":"Using Safety for Vulnerability Scanning","code":"$3a","language":"bash","explanation":"safety provides another layer of security scanning. Use both pip-audit and safety for comprehensive coverage."},{"title":"Automated Security Scanning in CI/CD","code":"$3b","language":"yaml","explanation":"Automate security scanning in CI/CD. Catch vulnerabilities before they reach production. Weekly scans detect new CVEs."}]}},{"id":"section-6","type":"concept","title":"Dependency Conflicts and Resolution","order":6,"content":{"explanation":"Dependency conflicts occur when Package A needs library-x==1.0 and Package B needs library-x==2.0. Pip's resolver tries to find compatible versions. Use pip check to detect conflicts, pipdeptree to visualize dependency tree, and resolve by finding compatible package versions.","codeExamples":[{"title":"Understanding Dependency Conflicts","code":"# Example conflict:\n# You want to install:\npip install package-a package-b\n\n# package-a requires:\n# library-x>=1.0,<2.0\n\n# package-b requires:\n# library-x>=2.0,<3.0\n\n# Conflict! No version satisfies both\n# pip shows:\nERROR: Cannot install package-a and package-b because these package versions have conflicting dependencies.\n\nThe conflict is caused by:\n package-a 1.0.0 depends on library-x<2.0\n package-b 2.0.0 depends on library-x>=2.0\n\n# Resolution options:\n# 1. Find different versions of package-a or package-b\n# 2. Use alternative package\n# 3. Report issue to package maintainers\n\n# Real example:\n# Flask 2.0 requires Werkzeug>=2.0\n# Old library requires Werkzeug<2.0\n# Cannot install both","language":"bash","explanation":"Conflicts happen when packages require incompatible versions of shared dependencies. pip's resolver detects these."},{"title":"Detecting Conflicts with pip check","code":"# Install packages\n$ pip install flask==2.0.0\n$ pip install flask-login==0.5.0\n\n# Check for conflicts\n$ pip check\n\nflask-login 0.5.0 has requirement Flask<2.0, but you have flask 2.0.0.\n\n# Problem: flask-login 0.5.0 doesn't support Flask 2.0\n\n# Solution: Upgrade flask-login\n$ pip install --upgrade flask-login\n$ pip check\n\nNo broken requirements found.\n\n# Always run pip check after installing packages\n# Especially when updating dependencies\n\n# In CI/CD:\n$ pip install -r requirements.txt\n$ pip check || exit 1 # Fail build if conflicts exist","language":"bash","explanation":"pip check detects incompatibilities after installation. Run it regularly to catch dependency issues early."},{"title":"Visualizing Dependencies with pipdeptree","code":"$3c","language":"bash","explanation":"pipdeptree visualizes dependency tree. Helps understand why packages are installed and detect conflicts."},{"title":"Resolving Conflicts: Practical Example","code":"# Scenario: You want modern Flask but have old extensions\n\n# Current state:\nFlask==1.1.4\nFlask-SQLAlchemy==2.4.4\nFlask-Login==0.5.0\n\n# You want: Flask 2.3.3\n$ pip install Flask==2.3.3\n\nERROR: Flask-Login 0.5.0 has requirement Flask<2.0\n\n# Resolution steps:\n\n# 1. Check if newer versions of extensions exist\n$ pip index versions Flask-Login\nFlask-Login (0.6.2)\nAvailable versions: 0.6.2, 0.6.1, 0.6.0, 0.5.0, ...\n\n# 2. Check compatibility\n# Visit PyPI: https://pypi.org/project/Flask-Login/0.6.2/\n# Requirements: Flask>=1.0.4\n\n# 3. Update all together\n$ pip install Flask==2.3.3 Flask-Login==0.6.2 Flask-SQLAlchemy==3.0.5\n\n# 4. Verify no conflicts\n$ pip check\nNo broken requirements found.\n\n# 5. Test application\n$ python -m pytest\n\n# 6. Update requirements.txt\n$ pip freeze > requirements.txt\n\n# 7. Commit\n$ git add requirements.txt\n$ git commit -m \"chore: upgrade Flask 1.1 -> 2.3 and extensions\"\n\n# Lesson: Update related packages together\n# Framework + extensions should have compatible versions","language":"bash","explanation":"Resolve conflicts by finding compatible versions of all related packages. Update framework and extensions together."}]}}]},"videoResources":{"primary":{"title":"Python Tutorial: pip - An in-depth look at the package management system","creator":"Corey Schafer","embedId":"U2ZN104hIcc","duration":"19:41","description":"⭐ Complete guide to pip package management. Corey covers installing packages, pip freeze for requirements.txt, version specifiers (==, >=, ~=), upgrading packages, uninstalling, and pip check for dependency conflicts. Essential for understanding complete pip workflow and managing Python dependencies professionally.","when":"MUST WATCH - Complete foundation for pip and requirements.txt"},"secondary":{"title":"Python Tutorial: VENV (Windows) - How to Use Virtual Environments","creator":"Corey Schafer","embedId":"APOPm01BVrk","duration":"6:43","description":"Shows how venv and requirements.txt work together for dependency management. Quick refresher on creating virtual environments and using pip freeze to generate requirements files. Good complement to understand the full workflow.","when":"Watch if you need refresher on venv + requirements.txt workflow"}},"challenges":[{"id":"challenge-60-1","title":"Create Requirements Files for Existing Projects","difficulty":"beginner","estimatedTime":"30 minutes","description":"Take 3 Python projects you've built (Flask app, data analysis script, automation tool). For each, create proper virtual environment, install dependencies, generate requirements.txt with pip freeze, and verify environment can be recreated from requirements file. Master the fundamental workflow used by every Python professional.","requirements":["Select 3 different Python projects from your portfolio (or create simple examples: Flask app, pandas script, requests automation)","For each project: create dedicated virtual environment with 'python -m venv venv'","Activate each environment and install project dependencies from memory or existing code","Run 'pip freeze > requirements.txt' to capture exact versions of all installed packages","Add header comment to each requirements.txt documenting: Python version required, project purpose, last updated date","Test recreation: delete venv directory, create fresh venv, run 'pip install -r requirements.txt', verify project runs","Create .gitignore entries for each project: include 'venv/', '__pycache__/', '*.pyc', '.env'","Document in README.md: setup instructions, virtual environment creation, dependency installation command","Compare requirements.txt across projects: identify common dependencies (requests, python-dotenv), project-specific (Flask vs FastAPI)","Generate requirements-comparison.md: table showing package version differences across your 3 projects, note any potential conflicts if combined"],"starterCode":"$3d","hints":["'pip freeze > requirements.txt' captures ALL packages in venv including dependencies - always use clean venv per project","Test requirements.txt immediately after creating: delete venv, recreate, verify - catches missing dependencies early","Add Python version to README: 'Python 3.11+' - requirements.txt doesn't specify Python version","Use 'pip list' to see installed packages before freezing - verify no unexpected packages","Common dependencies like 'requests' appear in many projects - note versions for consistency","Different projects might need different package versions: Flask 2.3 for legacy app, Flask 3.0 for new app",".gitignore must exclude venv/ - never commit 5000+ virtualenv files to Git","Recreate environment on different OS to test portability: some packages have OS-specific dependencies","pip freeze includes package hashes by default (--no-hashes to remove) - hashes ensure integrity","Practice explaining to junior developer: why requirements.txt in Git but venv/ in .gitignore"],"expectedOutcome":"Solid foundation in requirements.txt workflow used by every Python professional. Three working projects, each with clean requirements.txt enabling one-command setup. Understanding that requirements.txt is project's dependency memory: exact versions guaranteeing reproducibility. Mastery of complete workflow: create venv → activate → install dependencies → pip freeze → commit requirements.txt → gitignore venv/. Testing discipline: always verify requirements.txt by recreating environment - catches missing dependencies before teammates encounter them. Professional project structure: README with setup instructions, .gitignore excluding artifacts, requirements.txt with header comments. Recognition that this workflow scales: whether 3 packages or 300, whether solo dev or 100-person team, requirements.txt provides reproducible environments. Essential preparation for next steps: deploying to servers (Heroku, AWS), containerization (Docker), CI/CD pipelines - all require requirements.txt.","skills":["pip freeze","requirements.txt","Virtual environments","Project setup"]},{"id":"challenge-60-2","title":"Separate Production and Development Dependencies","difficulty":"intermediate","estimatedTime":"45 minutes","description":"Build Flask REST API with properly separated dependency files: requirements.txt (production essentials: Flask, gunicorn), requirements-dev.txt (adds development tools: pytest, black, flake8), requirements-test.txt (adds testing dependencies: pytest-cov, pytest-mock, faker). Learn why separating dependencies reduces Docker image size, deployment time, and security attack surface.","requirements":["Create Flask REST API with 5+ endpoints (users CRUD, health check) serving JSON responses","Create requirements.txt with production dependencies only: Flask==3.0.0, gunicorn==21.2.0, python-dotenv==1.0.0","Create requirements-dev.txt including production + development tools: -r requirements.txt, pytest, black, flake8, mypy, ipython","Create requirements-test.txt including dev + testing tools: -r requirements-dev.txt, pytest-cov, pytest-mock, faker, responses","Add Makefile with targets: 'make install-prod', 'make install-dev', 'make install-test' using appropriate requirements file","Create .env.example showing required environment variables (SECRET_KEY, DATABASE_URL) - never commit actual .env","Write tests using pytest with fixtures, mocking, and faker for test data generation","Configure pytest.ini with coverage threshold: 'addopts = --cov=app --cov-report=html --cov-fail-under=80'","Create Dockerfile using requirements.txt (production only - smaller image): 'pip install -r requirements.txt'","Document in DEPENDENCY_STRATEGY.md: why separate files, what goes where, CI/CD implications, cost savings","Compare Docker image sizes: production (Flask + gunicorn ~100MB) vs dev (+ pytest + black ~200MB)","Set up GitHub Actions: production deployment uses requirements.txt, test workflow uses requirements-test.txt"],"starterCode":"$3e","hints":["Use '-r requirements.txt' in requirements-dev.txt to avoid duplicating production dependencies","Production requirements.txt should be minimal: only packages needed to run app (not test/lint tools)","pytest, black, flake8 are development tools - never needed in production Docker container","Smaller production requirements = smaller Docker images = faster deployments = lower costs","Security: fewer packages in production = smaller attack surface (no pytest vulnerabilities in prod)","Makefile automates installation: 'make install-dev' for developers, 'make install-prod' for CI/CD","pytest.ini can set coverage thresholds: --cov-fail-under=80 fails if coverage below 80%","faker generates realistic test data: fake.name(), fake.email(), fake.address() - better than hardcoded 'test@test.com'","responses library mocks HTTP requests: test external API calls without hitting real APIs","Document separation strategy: helps new developers understand which dependencies go where"],"expectedOutcome":"$3f","skills":["Dependency separation","Environment management","CI/CD preparation","Docker optimization"]},{"id":"challenge-60-3","title":"Security Scan and Update Vulnerable Packages","difficulty":"intermediate","estimatedTime":"60 minutes","description":"Install security scanning tools (pip-audit, safety) and audit your project's dependencies for known vulnerabilities. Learn to read CVE reports, understand severity levels (CRITICAL, HIGH, MEDIUM), update vulnerable packages without breaking functionality, and automate security scanning in GitHub Actions CI/CD pipeline. Essential skill for maintaining production applications where security vulnerabilities can lead to data breaches costing millions.","requirements":["Install security scanning tools: 'pip install pip-audit safety bandit'","Run 'pip-audit' on existing requirements.txt - identify packages with known CVE vulnerabilities","Run 'safety check' for additional vulnerability database - compare results with pip-audit","Document all findings in SECURITY_AUDIT.md: package name, current version, vulnerability CVE ID, severity, exploit details","For each HIGH/CRITICAL vulnerability: research fix version, update package, run tests to verify no breaking changes","Handle breaking changes: if updated package breaks code, either fix code or pin to last secure version with workaround","Create .safety-policy.yml ignoring false positives or known non-exploitable vulnerabilities with justification","Scan application code for security issues with 'bandit -r .' - check for hardcoded secrets, SQL injection, weak crypto","Generate updated requirements.txt with all security patches applied and verified","Create GitHub Action (.github/workflows/security-scan.yml) running pip-audit on every PR and blocking merges if HIGH/CRITICAL vulnerabilities found","Set up automated weekly security scans with Dependabot or Renovate bot for continuous monitoring","Document security update workflow in SECURITY.md for team: how to handle vulnerability alerts, update process, testing requirements"],"starterCode":"$40","hints":["pip-audit is official PyPI tool - use as primary scanner, safety as secondary confirmation","CVE ID format: CVE-2023-12345 - search on cve.org for detailed exploit information","CVSS scores: 9.0-10.0=CRITICAL, 7.0-8.9=HIGH, 4.0-6.9=MEDIUM, 0.1-3.9=LOW","Read vulnerability descriptions carefully: some HIGH severity issues only exploitable in specific configurations","Test thoroughly after updates: package updates can introduce breaking API changes","Use 'pip install package==x.y.z' to install specific version, not 'pip install package' (gets latest)","bandit -r . scans all Python files recursively for hardcoded secrets, SQL injection, weak crypto","GitHub Actions can block PRs with security issues: fail workflow if HIGH/CRITICAL found","Dependabot creates PRs automatically for vulnerable packages - review and merge promptly","Document security workflow: team needs clear process for handling vulnerability alerts"],"expectedOutcome":"$41","skills":["Security scanning","Vulnerability management","CI/CD automation","Risk assessment"]}],"practiceProjects":[{"id":"project-60-1","title":"Requirements Management System","difficulty":"intermediate","estimatedTime":"2 hours","description":"Build CLI tool that: (1) Analyzes requirements.txt files, (2) Checks for outdated packages, (3) Scans for security vulnerabilities, (4) Generates upgrade recommendations, (5) Creates requirements-dev.txt and requirements-test.txt from requirements.txt. Use pip-audit, safety, and pip APIs.","skills":["File parsing","CLI development","Security scanning","Package management"],"successCriteria":["CLI accepts requirements.txt as input","Detects outdated packages with available versions","Scans for security vulnerabilities using pip-audit API","Generates separated requirements files","Outputs upgrade recommendations with version compatibility checks","Proper error handling for invalid requirements files"]}],"commonPitfalls":[{"id":"day60-pitfall-1","title":"Using pip freeze with global Python environment","howToFix":["Always create virtual environment first: python -m venv venv","Activate: source venv/bin/activate (Unix) or venv\\Scripts\\activate (Windows)","Install project dependencies only in venv","Then pip freeze > requirements.txt","Global environment has 100+ packages, venv has only your project's"],"whyItHappens":"Beginners pip freeze from global Python environment capturing every package ever installed. requirements.txt becomes 200+ lines of unrelated packages. When deploying, all those packages install—slow, bloated, conflicts."},{"id":"day60-pitfall-2","title":"Not pinning versions (no version specifiers)","howToFix":["Bad: Flask (no version)","Good: Flask==2.3.3 (exact version)","Better: Flask~=2.3.3 (allow patches)","Use pip freeze which always includes versions","For libraries you publish: Flask>=2.0,<3.0 (compatibility range)"],"whyItHappens":"Writing requirements.txt manually without versions: 'Flask\\nrequests'. pip installs latest versions. Code works today, breaks tomorrow when packages update. Version pinning ensures reproducibility—same versions today, tomorrow, next year."},{"id":"day60-pitfall-3","title":"Committing .env files and secrets to requirements.txt comments","howToFix":["Never put secrets in requirements.txt comments","Use environment variables, not comments: # API_KEY=abc123 (WRONG)","Add .env to .gitignore","Use python-dotenv for environment variables","Document in README that .env file is needed, not actual secrets"],"whyItHappens":"Developers put configuration in requirements.txt comments for 'documentation'. These get committed to Git, exposed on GitHub. Use .env files (gitignored) and environment variables for secrets."},{"id":"day60-pitfall-4","title":"Ignoring security vulnerabilities","howToFix":["Run pip-audit regularly: pip-audit","Update vulnerable packages immediately","Set up automated scanning in CI/CD","Subscribe to security advisories for critical packages","Use Dependabot or Renovate for automated updates"],"whyItHappens":"Developers install packages once, never update. Months later, packages have critical vulnerabilities (SQL injection, remote code execution). Production apps get hacked. Regular security scanning catches issues before attackers do."}],"connections":{"previous":{"content":"Day 59 covered virtual environments for dependency isolation. Now you'll document those dependencies in requirements.txt for team collaboration and deployment.","prerequisites":"Understanding of virtual environments (venv) and pip install is essential from Day 59."},"current":{"keyTakeaways":["requirements.txt ensures reproducible environments—same versions everywhere","pip freeze captures exact dependency versions for reliability","Version specifiers (==, ~=, >=) balance safety vs flexibility","Separate production, development, and test dependencies for cleaner deployments","Security scanning (pip-audit, safety) prevents deploying vulnerable packages","pip check and pipdeptree help detect and resolve dependency conflicts"]},"next":{"preview":"Tomorrow you'll containerize Python applications with Docker, using requirements.txt for reproducible container builds.","teaser":"requirements.txt makes dependencies reproducible on any machine. Docker makes entire environment (OS, Python, packages) reproducible..."}},"reflectionQuestions":[{"id":"day60-reflect-1","question":"Why is pip freeze > requirements.txt in a clean virtual environment better than manually writing dependency names?","purpose":"Understand that pip freeze captures complete dependency tree with exact versions, not just direct dependencies."},{"id":"day60-reflect-2","question":"When would you use == vs ~= vs >= for version specifiers? What are the tradeoffs?","purpose":"Learn that == provides maximum reproducibility, ~= allows security patches, >= is risky for breaking changes."},{"id":"day60-reflect-3","question":"Why should production deployments use separate requirements.txt without development tools like pytest and black?","purpose":"Recognize that minimal production dependencies reduce attack surface, deployment time, and Docker image size."}],"metadata":{"estimatedTime":"4 hours","difficulty":"intermediate","prerequisites":["Virtual environments (Day 59)","pip basics","Command line"],"topics":["requirements.txt","pip freeze","dependency management","version pinning","security scanning"],"tags":["python","dependencies","requirements","pip","security","devops"]}},"topicSlug":"python","navigation":{"previous":{"dayNumber":59,"title":"Virtual Environments and Dependency Management","sprintNumber":3},"next":{"dayNumber":61,"title":"Docker Basics and Containerization","sprintNumber":3}},"dayNumber":60,"totalDays":66,"mathEnabled":false,"starterCode":"# Monday: You develop app\npip install requests\n# Gets requests 2.31.0 (latest)\n\n# Your code:\nimport requests\nresponse = requests.get('https://api.example.com')\n# Works perfectly!\n\n# Friday: Teammate clones repo\npip install requests\n# Gets requests 2.32.0 (new release with breaking changes)\n\n# Same code, different behavior:\nimport requests\nresponse = requests.get('https://api.example.com')\n# Error: requests.exceptions.SSLError\n# requests 2.32 changed SSL verification behavior\n\n# Problem: No version control of dependencies\n# Solution: requirements.txt with pinned versions"}]}]}]]}]