Check dependencies recursively

[andy-maier]

It seems that pip-check-reqs only checks the first level of dependencies of the package that is specified, but not any further dependencies of those dependencies.

Please add an option to check the dependencies recursively.

[adamtheturtle]

Hi @andy-maier , please can you explain why (IIUC) you want to rely on dependencies not specified in your requirements list?

[andy-maier]

@adamtheturtle

We are NOT having indirect dependencies in the requirements.txt file and thus also not in the package on Pypi. Where we have indirect dependencies is in a minimum-constraints.txt file that specifies minimum versions we support. That file is used by pip with its -c option to set up specific virtual envs with a defined minimum version of packages for testing, in order to be really sure that any minimum statement we have in the requirements.txt file actually works. If you don't test against it, you simply don't know for sure whether a minimum statement made in requirements.txt actually works.
The desire to have a defined minimum set of versions also applies to the indirect dependencies.

We have a "check_reqs" make target that runs pip-missing-reqs multiple times:

• for our own package with the requirements.txt file - for checking missing dependencies in the Pypi package
• for our own package with the minimum-constraints.txt file - for making sure our minimum set of versions is complete so we can know we have a reasonable test of our package with minimum versions
• for a number of Python based commands used in development with the minimum-constraints.txt file, for the same reason, although that is just for our dev env

See for example the Makefile, requirements.txt, minimum-constraints.txt file and the Actions runs of the https://github.com/zhmcclient/python-zhmcclient project.

What I am seeing in the pip-missing-test runs that use the minimum-constraints.txt file is that some packages that are indirect dependencies of the packages used, but not specified in the minimum-constraints.txt file are not reported by pip-missing-reps. That's why I assumed that it does not check indirect dependencies of the package you run it on. Tha iss an issue for us because we want to make sure that all (direct and) indirect dependencies are in the minimum-constraints.txt file. We would turn on a recursive option of pip-missing-reqs in all runs where the minimum-constraints.txt file is used.

[adamtheturtle]

Thank you @andy-maier for explaining. I don't have availability to develop this feature, but I'll leave this open in case someone else wishes to.