pip and Dependency Management

Most real Python projects depend on third-party packages from PyPI — requests, pandas, FastAPI, SQLAlchemy. Installing them correctly, keeping versions reproducible across machines, and isolating each project's dependencies are essential professional skills.

This lesson covers pip commands, requirements files, version specifiers, pyproject.toml, and modern tools such as uv and Poetry, building on the virtual environments lesson.

pip Basics

Always run pip as python -m pip so it installs into the interpreter you are using, and always inside an activated virtual environment. Key commands: install, install --upgrade, uninstall, list, show, freeze, and install -r requirements.txt.

Versions and Requirements Files

Version specifiers: ==2.32.3 (exact), >=2.30, ~=2.32 (compatible release: at least 2.32, below 3.0), <3. A requirements.txt lists dependencies one per line. Applications should pin exact versions (a "lock") so every deployment gets identical packages; libraries should declare looser ranges.

pyproject.toml

pyproject.toml is the standard project configuration file: project name, version, Python requirement, dependencies, optional groups (dev, test) and tool settings (Ruff, pytest, mypy). Tools like uv, Poetry, Hatch and pip itself understand it.

uv and Poetry

uv (by Astral) is a very fast, all-in-one tool: it installs Python versions, creates virtual environments, adds dependencies to pyproject.toml, writes a lock file (uv.lock) and runs commands — uv init, uv add fastapi, uv run app.py. Poetry offers a similar workflow. Either is a big improvement over manual pip + requirements files for team projects.

Examples

Everyday pip commands (inside an activated virtual environment)

Python

python -m pip install requests
python -m pip install "fastapi[standard]==0.118.0"
python -m pip install --upgrade requests
python -m pip show requests
python -m pip list --outdated
python -m pip uninstall requests
python -m pip freeze > requirements.txt
python -m pip install -r requirements.txt

Output

Successfully installed requests-2.32.x certifi-... charset-normalizer-... idna-... urllib3-...
Name: requests
Version: 2.32.x
Summary: Python HTTP for Humans.
Requires: certifi, charset-normalizer, idna, urllib3

A requirements file and a pyproject.toml

Python

# requirements.txt (application: pinned versions)
fastapi==0.118.0
uvicorn==0.37.0
sqlalchemy==2.0.43
python-dotenv==1.1.1

# pyproject.toml
[project]
name = "webnest-api"
version = "0.1.0"
requires-python = ">=3.12"
dependencies = [
    "fastapi[standard]>=0.115",
    "sqlalchemy~=2.0",
]

[dependency-groups]
dev = ["pytest>=8", "ruff>=0.6"]

[tool.ruff]
line-length = 100

Output

(Pin exact versions for deployable apps; declare ranges in libraries.)

A modern workflow with uv

Python

# install uv once: https://docs.astral.sh/uv/  (e.g. pip install uv)
uv init webnest-api
cd webnest-api
uv add "fastapi[standard]" sqlalchemy
uv add --dev pytest ruff
uv run fastapi dev main.py        # runs inside the project's managed .venv
uv lock                           # writes uv.lock with exact versions
uv sync                           # recreate the exact environment on another machine

Output

Initialized project webnest-api
Resolved 38 packages in 412ms
Installed 38 packages in 96ms

Checking installed package versions from code

Python

from importlib.metadata import version, PackageNotFoundError

for package in ["pip", "surely-not-installed-package"]:
    try:
        print(package, "->", "installed" if version(package) else "?")
    except PackageNotFoundError:
        print(package, "-> not installed")

Output

pip -> installed
surely-not-installed-package -> not installed

Common Mistakes

Installing packages globally instead of in a virtual environment.
Running pip from a different Python than the project uses; use python -m pip.
Deploying with unpinned dependencies, so a new release breaks production.
Committing the .venv folder to Git instead of requirements/lock files.

Key Points to Remember

Use python -m pip inside a virtual environment.
Version specifiers: ==, >=, ~=, <; pin exact versions for applications.
requirements.txt lists dependencies; pyproject.toml is the modern project file.
uv (and Poetry) manage environments, dependencies and lock files in one tool.

Practice the examples

Change an input, predict the result, then compare it with the output. Explain why the result changes.

Use your local project environment for these examples. Codelab currently runs Python and HTML/CSS/JavaScript; framework examples may need project dependencies.