Remove duplicate entries from requirements.txt#854
Remove duplicate entries from requirements.txt#854shiwani42 wants to merge 1 commit intoOWASP:mainfrom
Conversation
requirements.txt had accumulated duplicate package entries from separate commits that each added packages without checking for existing entries. Removed duplicates: playwright, psycopg2-binary, pygithub (kept PyGithub), python_markdown_maker (kept python-markdown-maker), scikit_learn (kept scikit-learn), setuptools, SQLAlchemy, compliance-trestle.
|
@shiwani42 Hey Shiwani , before raising a PR , please pin Spyros or me to validate the issue , you are trying to solve ? This way we might give you some suggestion to make the issue more reasonable and important . |
|
@shiwani42 I want to ask you in this PR how we will get to know which version of the package is actually in use ! which one is relevant ? |
Thanks for the heads up, will ping before raising PRs next time. Sorry for skipping that. |
All duplicates are unpinned on both sides, so no version ambiguity. pip resolves to the same version regardless. The removal just cleans up the redundant lines. |
|
@shiwani42 agreed that since the dependencies are unpinned, removing redundant entries won’t change how pip resolves them. That said, I think this highlights a bigger issue in our setup: since we don’t pin versions in requirements.txt, the environment is not deterministic. Pip will install the latest compatible versions each time, which means different developers (or CI) could end up with different versions and potentially different behavior or breakages. To make this more reliable, we should consider locking dependencies to exact versions (e.g., using pip freeze or a tool like pip-tools/poetry). This way we ensure reproducible builds and avoid unexpected issues in the future. Would you be open to adding pinned versions as a follow-up? |
|
Thanks for the context! I'll close this PR and open a new issue specifically for pinning the dependencies to exact versions, then raise a fresh PR for that. |
|
@shiwani42 I am closing the issue , reopen a new one with updated context |
Summary
Fixes #853
requirements.txthad accumulated duplicate package entries from separate commits that each added packages without checking for existing entries.Removed duplicates:
playwright(second occurrence)psycopg2-binary(second occurrence)pygithub(keptPyGithub)python_markdown_maker(keptpython-markdown-maker)scikit_learn(keptscikit-learn)setuptools(second occurrence)SQLAlchemy(second occurrence)compliance-trestle(second occurrence)neo4jandneomodelwere verified as distinct packages and are not affected.Test plan
sort requirements.txt | uniq -direturns no outputpip install -r requirements.txtcompletes without conflicts