Errors detected in .deepsource.toml.
Pin versions in
pip DOK-DL3013
Bug risk
Major
4 years ago
—
4 years old
Pin versions in pip. Instead of
pip install <package> use pip install <package>==<version>45
46# Install readthedocs-ext only if GITHUB_TOKEN is provided
47WORKDIR /usr/src/app/checkouts/
48RUN if [ -n "$GITHUB_TOKEN" ] ; \49 then \
50 git clone --depth 1 https://${GITHUB_TOKEN}@github.com/readthedocs/readthedocs-ext ; \
51 pip3 install --no-cache-dir -e readthedocs-ext ; \Pin versions in pip. Instead of
pip install <package> use pip install <package>==<version>32RUN sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen && \
33 locale-gen
34
35RUN pip3 install --no-cache-dir --upgrade pip36
37# Ensure that ``python`` is in the PATH so that ``./manage.py`` works
38RUN ln -s /usr/bin/python3 /usr/bin/python
Description
Version pinning forces the build to retrieve a particular version regardless of what’s in the cache. This technique can also reduce failures due to unanticipated changes in required packages. You can read more about version pinning here.
Bad Practice
FROM python:3.4
RUN pip install django
RUN pip install https://github.com/Banno/carbon/tarball/0.9.x-fix-events-callback
Recommended
FROM python:3.4
RUN pip install django==1.9
RUN pip install git+https://github.com/Banno/[email protected]
References
You can also specify the requirements in a text file and pass it to pip as shown here.