Overview

The module pyTooling.Dependency models the dependencies between packages: which package depends on which version of which other package, where those packages are published, and what the resulting graph looks like.

See also

This is about modelling dependencies. The dependencies of pyTooling itself are listed in Dependencies.

Data Model

The generic data model is storage agnostic - it describes packages and versions without assuming where they come from:

  • Package is a package by name, with the versions it has.

  • PackageVersion is one version of a package, when it was released, and which versions of which other packages it depends on.

  • PackageStorage is a place packages are published - an index, a registry, a repository.

  • PackageDependencyGraph collects the packages known from one or more storages.

Python Packages

pyTooling.Dependency.Python implements that model for Python packages published on PyPI:

  • Project and Release are the Python flavours of a package and a package version.

  • Distribution describes a single distribution file of a release - a wheel or a source distribution.

  • PythonPackageIndex queries PyPI, and PythonPackageDependencyGraph is the graph built from it.

Details are fetched on demand rather than up front: a project knows its releases before it knows anything about them, and LazyLoadableMixin loads the rest when it is first asked for. A dependency graph is otherwise thousands of HTTP requests wide.

Attention

Querying PyPI needs aiohttp, which is an optional dependency. Install it with the pypi extra:

pip install pyTooling[pypi]

Without it, importing pyTooling.Dependency.Python raises an exception naming the extra. The generic data model in pyTooling.Dependency has no such requirement.

Exceptions and Warnings

DependencyException is the base of the module’s exceptions: NoSessionAvailableException when a query is attempted without an open session, ProjectNotFoundException and ReleaseNotFoundException when the index does not know what was asked for.

A malformed requirement or unreadable release metadata does not abort the traversal - it is reported as a BrokenRequirementWarning or ReleaseDetailsWarning, because one bad package should not hide the rest of the graph.