[Cli Docs?] Conflicting Info in regards to `pipenv lock --dev --requirements`

[gtalarico]

Overview

Docs, Actual Results, and CLI Help are in conflict:
Should --dev include only dev dependencies? Or both dev + default dependencies?

Actual Results

pipenv lock --dev --requiremnts

Outputs only dev dependencies

Docs

States that --dev should output only dev dependencies

If you wish to generate a requirements.txt with only the development requirements you can do that too! ... pipenv lock -r --dev

https://pipenv.readthedocs.io/en/latest/advanced/#generating-a-requirements-txt

CLI usage

States --dev should includes both dev + default dependencies:

  -d, --dev           Install *both* develop and default packages.  [env var: PIPENV_DEV]

pipenv, version 2018.11.26

[gtalarico]

@frostming please confirm: is CLI docs incorrect and expected behaviour is dev deps only

[frostming]

Let me try to clarify it. We re-organized the commands and options to reduce repetitions. And the --dev option is taken from a common option, which is documented as "install both develop and default packages", whereas, as you found, behaves differently between commands.

In the context of lock -r, it is likely that people use it to generate the old-fashioned requirements.txt and dev-requirements.txt, so it is more expected the two sections are generated separately. Now what we should do is to replace the common option to a specific one with the correct document string to reflect what it does. Contributions are welcomed.

It is just my opinion and it might be wrong. Kenneth should have some words for it.

[frostming]

@gtalarico I just changed my mind and modified the previous comment a lot, sorry for the trouble.

[gtalarico]

I understand the logic, but using the same exact --dev flag for opposite behaviors smells funny to me
🙊

Edit

Did i get this right?

Command	Flags	Default Deps	Dev Deps
pipenv install	none	✅	❌
pipenv install	--dev	✅	✅
pipenv lock	none	✅	✅
pipenv lock	--requirements	✅	❌
pipenv lock	--requirements --dev	❌	✅

• installing only dev dependencies is possible using (ok, edge case use)

pipenv lock -r -d > requirements-dev.txt && pip install requirements-dev.txt

[jxltom]

@gtalarico You are right as shown in the table. Currently --dev has different logic for install and lock -r

Install only dev packages is not a typical usage but you can do that by pipenv lock -r -d > requirements-dev.txt && pip install requirements-dev.txt.

By default, pipenv lock is locking both default and dev. I think --dev is not working for pipenv lock --dev (correct me if i'm wrong) which needs enhancement.

[gtalarico]

install only dev packages is not a typical usage but you can do that by pipenv lock -r -d > requirements-dev.txt && pip install requirements-dev.txt.

I think that's good enough given how unusual of a use case that is.

By default, pipenv lock is locking both default and dev

Updated the table above to reflect this

[techalchemy]

@gtalarico the api is backwards when you dump requirements, I didn't like that when it was implemented but it's probably too late to undo it

@jxltom it's technically impossible to lock dev packages on their own in any meaningful way with the current implementation of locking. Even if we keep the dev dependencies separate, they can't ever be allowed to conflict with the production dependencies, which means we currently just overwrite dev dependencies as they are generated if they conflict.

It's not possible to generate them independently because by nature the dev dependencies require the default dependencies to exist and be up to date first, otherwise there is no way to be sure they are not in conflict.

[jxltom]

@techalchemy Thanks for explanation. I feels same for that locking default and dev deps independently is not possible and also it is not a typical use. Maybe we could consider removing --dev options for pipenv lock otherwise it will confuse users.

[frostming]

@jxltom I doubt if there is a way to do this since --dev is needed by lock -r.

[jxltom]

@frostming Oh, yes, I missed that... Thanks for the kind reminder. I don't know whether click has this kind of support which accepts only lock or lock -r -d but not lock -d. The other way is to raise a warning manually for user when pipenv lock --dev is used.

[gtalarico]

Maybe we could propose a change... ?
Remove --dev flag due to its amiguitiy and opposite behavior of install dev flag.

Use lock --requirements and lock --requirements-dev to generate requirements txt and requirements dev txt