Updating only one locked dependency

Sometimes I’m doing a PR and I want to update a specific dependency but I don’t want to deal with updates of all my dependencies (aiohttp, flake8, etc…). If any breaking change was introduced in those dependencies, I want to deal with it in another PR.

As far as I know, the only way to do that would be to pin all the dependencies that I don’t want to update in the Pipfile. But I find it to defeat the purpose of Pipenv in the first place 😃 .

So my feature request would be to be able to do something like:

$ pipenv lock --only my-awesome-dep

That would generate a Pipfile.lock with updates for only my-awesome-dep and its dependencies.

I can probably make a PR for that, but I would like to get some feedback first.

[brettdh]

Agree 100% - and I’ll go a bit farther: this should be the default.

That is, pipenv install foo should never touch anything besides foo and its dependencies. And pipenv lock should certainly never upgrade anything - it should just lock what’s already installed.

AFAICT, this is how npm, yarn, gem, etc. work; it makes no sense to have a lockfile that doesn’t actually lock packages, but trusts package authors to not break things in patch releases, and therefore upgrades them without being asked. I can see the use of allowing upgrades, but that should be opt-in, since it’s more surprising than not upgrading them.

I apologize if I’m hijacking this issue for something else, but since this is so closely related to an issue I was about to create, I thought I’d start the conversation here. Feel free to tell me I should make a new one.

[kennethreitz]

I have no idea.