🧰 Python Package Management with pip

pip and PyPI

pip (the "Pip Installs Packages" installer) is the standard tool for adding third-party code to a Python project. It downloads packages from PyPI — the Python Package Index at pypi.org — the public "app store" for Python libraries, hosting well over 600,000 projects.

pip ships with Python (3.4+), so it's almost always already there. Always run it against an activated virtual environment (previous lesson) so installs stay isolated. Verify and update it with:

# Check pip's version (both forms work)
pip --version
python -m pip --version

# Keep pip itself up to date
python -m pip install --upgrade pip

Essential pip Commands

A handful of commands cover almost all day-to-day work.

Installing

# Install the latest version
pip install requests

# Install an exact version
pip install requests==2.31.0

# Install within a range
pip install "requests>=2.28,<3.0"

# Install everything a project needs
pip install -r requirements.txt

# Install your own project in "editable" mode (changes take effect live)
pip install -e .

Inspecting

pip list                 # everything installed
pip show requests        # details about one package
pip list --outdated      # what has newer versions available
pip freeze               # installed packages in requirements format

Uninstalling

pip uninstall requests

Version Specifiers

When you declare a dependency, you also declare which versions are acceptable. Getting this right is the difference between "works on my machine" and reproducible builds.

Dependency Resolution

When you install a package, pip also installs everything it depends on — and everything those depend on. Since pip 20.3, a stricter resolver checks that the whole tree is mutually compatible, and reports an error if no combination works.

Here both A and B depend on C. The resolver looks for a version of C satisfying both constraints — for example C 1.6. If A demanded C<1.5 while B demanded C>=1.5, no version could satisfy both and pip would report a conflict.

Managing requirements.txt

A requirements.txt file lists a project's dependencies so anyone can install them in one command and get the same environment.

# Snapshot the current environment (all packages, exact versions)
pip freeze > requirements.txt

# Recreate the environment elsewhere
pip install -r requirements.txt

For most applications, a hand-maintained file of direct dependencies is clearer than a raw freeze. You can also comment it:

# requirements.txt
Django>=4.2,<5.0
requests==2.31.0
python-dotenv>=1.0.0
psycopg2-binary==2.9.9   # PostgreSQL driver

Layered requirement files

Real projects separate concerns: shared deps, plus extras for development and production. Use -r to include one file from another.

# requirements-base.txt  — needed everywhere
Django>=4.2,<5.0
requests>=2.31.0
python-dotenv>=1.0.0

# requirements-dev.txt    — local development only
-r requirements-base.txt
pytest>=7.3
black>=23.3
ruff>=0.1

# requirements-prod.txt   — production only
-r requirements-base.txt
gunicorn>=21.2
psycopg2-binary==2.9.9

# Developers install:
pip install -r requirements-dev.txt
# The production server installs:
pip install -r requirements-prod.txt

# with pip-tools
pip install pip-tools
pip-compile requirements.in            # -> pinned requirements.txt
pip-sync requirements.txt              # make the env match exactly

# uv does the same, much faster
uv pip compile requirements.in -o requirements.txt

Supply-Chain Security

Installing a package runs someone else's code with your permissions. That convenience is also a risk vector, so treat dependencies with care.

Defenses

• Pin versions in production so a surprise release can't slip in unnoticed.
• Scan for vulnerabilities regularly with pip-audit.
• Verify integrity with hashes so a tampered file is rejected at install time.
• Avoid sudo pip — install into a virtual environment, not system Python.

# Scan installed packages for known vulnerabilities
pip install pip-audit
pip-audit

# Or scan a requirements file
pip-audit -r requirements.txt

Hash-checking mode makes pip refuse any file whose contents don't match the recorded hash:

# requirements.txt with a pinned hash
requests==2.31.0 \
    --hash=sha256:942c5a758f98d790eaed1a29cb6eefc7ffb0d1cf7af05c3d2791656dbd6ad1e1

Tools like pip-compile --generate-hashes or uv produce these files for you.

Hands-on Exercise

mkdir weather_app && cd weather_app
python -m venv .venv
source .venv/bin/activate        # Windows: .venv\Scripts\activate

# Install direct dependencies
pip install flask requests python-dotenv

# requirements-base.txt
flask>=3.0,<4.0
requests>=2.31,<3.0
python-dotenv>=1.0,<2.0

# requirements-dev.txt
-r requirements-base.txt
pytest>=7.3
ruff>=0.1

# requirements-prod.txt
-r requirements-base.txt
gunicorn>=21.2

# Produce a fully-pinned snapshot and scan it
pip freeze > requirements-lock.txt
pip install pip-audit
pip-audit -r requirements-lock.txt

Best Practices

Summary & Quiz

📚 Further Reading

• pip Documentation
• Python Packaging User Guide
• pip-audit
• uv Documentation
• Real Python — What Is pip?

🚀 What's Next?

You've now covered Python's backend landscape, isolated environments, and dependency management. Next we cross into a different ecosystem with the same fundamentals: PHP for Backend Development.