Dependencies

requirements* files

Each Python app should have:

• requirements.txt - pinned versions of all production dependencies
• requirements.in - main / top-level dependencies, used to generate requirements.txt
• requirements_for_test.txt - additional dependencies for dev / test

requirements.txt is generated from the requirements.in in order to pin versions of all nested dependencies. If requirements.in has been changed, run make freeze-requirements to regenerate it.

Updating dependencies

Currently we do this as-and-when. We should prioritise dependencies with security vulnerabilities.