Pinning Your Dependencies
The cookbook runs on your laptop. A teammate clones it, installs "Django", gets a newer release than yours, and a page that works for you crashes for them. The code was identical; the packages were not. The cure is a plain text file that says exactly what the project runs on.
The rule
Share the list, not the folder:
requirements.txtrebuilds any environment.
A requirements file lists one package per line, usually with an exact version (== is called pinning):
asgiref==3.9.1
Django==5.2.6
sqlparse==0.5.3You can write it by hand, or capture what is installed in the active environment:
pip freeze > requirements.txtpip freeze prints every package in the environment with its exact version, including the dependencies Django pulled in. That is why a clean environment matters: freeze a messy one and the list fills with packages the project never uses.
On any other machine, rebuild it:
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txtThe -r flag means "read the requirements from this file". Commit requirements.txt to the repository; keep .venv/ in .gitignore.
Exact pins give repeatable installs. When you want to upgrade, do it on purpose: install the newer version, run the tests, then freeze again and commit the new list.
(Tools like Poetry and uv keep the same idea in a lock file. The file name changes; the principle does not.)
The shortcut
Every time you pip install something new, finish the move with pip freeze > requirements.txt and commit. Install and freeze are one gesture.
Install
With
(.venv)active,pip install pillowso recipes can have photos.
The trap is installing something, forgetting to freeze, and pushing code that imports a package the file never mentions. It works on your machine only.
Drills
Answer fast — trust the rule.
Which command installs everything listed in requirements.txt?
What does Django==5.2.6 in a requirements file mean?
Why freeze from a clean, project-only environment?
Which of these belongs in the Git repository?
Remember
- Share the list, not the folder:
requirements.txtrebuilds any environment. - Install and freeze are one gesture; commit the file with the code.
- Trap: an import that is not in the file only works on your machine.