Simplify dependency management

[dagpunk]

I currently have requirements.in and requirements.txt files that are used in combination with pip and pip-tools to manage project dependencies and installed dependencies in various environments.

One nice thing about using pip-tools's pip-compile command is that you no longer have to ensure all dependencies of the top-level dependencies are installed and at the correct version. Instead, you only specify the top-level dependencies in requirements.in and then compile the more detailed requirements.txt.

While this is arguably superior to having a single, manually-maintained requirements.txt file, it still feels overly complicated.

I have read suggestions to use a metadata-driven approach via setup.cfg or pyproject.toml and maintain the top-level dependencies there. I think this would be a positive change, as it would eliminate the need to compile the second file. Dependabot should still be compatible with projects managing dependencies via setuptools.

References

• https://python-packaging.readthedocs.io/en/latest/dependencies.html
• https://til.simonwillison.net/github/dependabot-python-setup

[dagpunk]

Another thing to consider related to this: the use of a dev-requirements.in file to track development requirements.