Planet Python
Follow
Brett Cannon: Why it took 4 years to get a lock files specification
The journey to establish a standardized Python lock file format, pylock.toml, spanned over four years, involving extensive discussion and iteration. A lock file aims to precisely record all dependencies and their specific installation methods, accounting for various package formats like wheels and source distributions. Defining what dependencies are needed and when they apply, especially with optional dependencies and version specifiers, proved complex. This complexity arises because dependency resolution is an NP-complete problem, compounded by the desire for a human-readable, secure, and efficient format.The process began with informal discussions in 2019, evolving into more formal proposals like PEP 665 in 2021, which ultimately failed due to its exclusivity of wheels. Subsequent solitary efforts in 2023 led to the development of necessary tooling and a proof-of-concept. The emergence of tools like uv in 2024 presented new challenges and requirements, necessitating further draft revisions of PEP 751.Disagreements over multi-use versus single-use lock files and specific features caused significant delays and required strict adherence to feedback timelines. After numerous discussions and compromises across key projects like uv, Poetry, and PDM, PEP 751 was finally accepted on March 31, 2025. This achievement marks the culmination of years of intense debate, with early adoption by PDM, uv, and pip demonstrating the format's viability. The author expresses a desire to move on to other areas of Python development after significant contributions to packaging standards.