Why should version numbers not be pinned in a Pipfile?

The docs are quite opinionated on the likely reason you have pinned versions on your requirements file: it probably came from pip freeze > requirements.txt.

Of course you’ll want to specify some or all version ranges in your Pipfile, it’s just that many people have them pinned in the requirements.txt because they used to treat it like a kind of Pipfile.lock, specifying versions of packages that aren’t even direct dependencies. Naturally, if you didn’t follow this practice, you don’t have to worry about that warning.

This is very likely the result of Kenneth Reitz (Pipenv creator) himself doing that previously, as mentioned in his blog post A Better Pip Workflow. Clarification on this matter was already asked and answered by him in the official repository.

UPDATE JUNE, 2018

That message used to be printed as a warning by the pipenv command as well, but it has been replaced with

requirements.txt found, instead of Pipfile! Converting…
Warning: Your Pipfile now contains pinned versions, if your requirements.txt did.
We recommend updating your Pipfile to specify the "*" version, instead.

A little bit more friendly, but I think it’s still implicitly saying that pinning versions on Pipfile is not ideal, which is not true. It’s perfectly fine.

Leave a Comment

tech