Packages and Dependencies Checkpoint

25 min · Intermediate

Fix the mistakes

The slips that cost marks in this module. Spot each one, then check the fix.

Everything in this module meets in one project: a package folder, a pyproject.toml, a set of pinned dependencies and a release. This checkpoint walks through them and then tests your choices.

Lay out and describe the project

A shippable project has a package folder with an __init__.py, and one pyproject.toml beside it. Ask of each file: who reads it, and what happens if it is missing?

Example 1 · Checking a project file

Python

1import tomllib2
3text = """4[build-system]5requires = ["setuptools>=68"]6build-backend = "setuptools.build_meta"7
8[project]9name = "shopkit"10version = "0.1.0"11requires-python = ">=3.10"12dependencies = ["python-dateutil>=2.8"]13"""14
15
16def problems(config):17    found = []18    if "build-system" not in config:19        found.append("missing [build-system]")20    project = config.get("project", {})21    for key in ("name", "version", "requires-python"):22        if key not in project:23            found.append(f"missing {key}")24    return found25
26
27print(problems(tomllib.loads(text)))28print(problems(tomllib.loads("[project]\nname = \"x\"")))

Output

[]
['missing [build-system]', 'missing version', 'missing requires-python']

What this code does

The function lists what is missing, so an empty list means the file has the basics.
The second file has a name only, so it reports three gaps.

Without __init__.py the folder is not a regular package. Without [build-system], pip guesses how to build. Without name and version, there is nothing to install or publish.

Choose where each version rule lives

Ranges go in pyproject.toml, so the package fits with other people's code. Exact versions go in a lock file or requirements.txt, so your own application is repeatable.

Example 2 · Where rules live

Python

1ranges = ["python-dateutil>=2.8"]2lock = {"python-dateutil": "4.0.0", "tzdata": "2026.6"}3
4for rule in ranges:5    name = rule.split(">=")[0]6    print(f"{name}: rule {rule}, locked at {lock[name]}")7print("locked but not in the rules:", sorted(set(lock) - {r.split(">=")[0] for r in ranges}))

Output

python-dateutil: rule python-dateutil>=2.8, locked at 4.0.0
locked but not in the rules: ['tzdata']

What this code does

The rule says what is allowed. The lock says what was tested.
tzdata appears only in the lock, because it is a transitive dependency.

Tools for development, such as mypy, go in an optional dev group. They should never be forced on the users of the package.

Check before you publish

Build, list, install and import. Each step catches a different mistake: a bad pyproject.toml, a stray file in the wheel, a missing module, or a version that was already used.

Example 3 · A release check

Python

1def ready(version, published, wheel_files):2    problems = []3    if version in published:4        problems.append("version already published")5    if any(name.endswith(".env") for name in wheel_files):6        problems.append("secret file in wheel")7    return problems or ["ok"]8
9print(ready("0.2.0", ["0.1.0"], ["shopkit/__init__.py"]))10print(ready("0.1.0", ["0.1.0"], ["shopkit/__init__.py", "shopkit/.env"]))

Output

['ok']
['version already published', 'secret file in wheel']

What this code does

Two real release mistakes are caught: a used version number and a secret in the package.
On a real project, the file list comes from listing the wheel.

Use TestPyPI to practise. Keep upload tokens out of the code, and raise the version for every release.

Finish up

Mark this lesson complete

This is the last lesson in this section.

1import tomllib2 3text = """4[build-system]5requires = ["setuptools>=68"]6build-backend = "setuptools.build_meta"7 8[project]9name = "shopkit"10version = "0.1.0"11requires-python = ">=3.10"12dependencies = ["python-dateutil>=2.8"]13"""14 15 16def problems(config):17 found = []18 if "build-system" not in config:19 found.append("missing [build-system]")20 project = config.get("project", {})21 for key in ("name", "version", "requires-python"):22 if key not in project:23 found.append(f"missing {key}")24 return found25 26 27print(problems(tomllib.loads(text)))28print(problems(tomllib.loads("[project]\nname = \"x\"")))

1ranges = ["python-dateutil>=2.8"]2lock = {"python-dateutil": "4.0.0", "tzdata": "2026.6"}3 4for rule in ranges:5 name = rule.split(">=")[0]6 print(f"{name}: rule {rule}, locked at {lock[name]}")7print("locked but not in the rules:", sorted(set(lock) - {r.split(">=")[0] for r in ranges}))

1def ready(version, published, wheel_files):2 problems = []3 if version in published:4 problems.append("version already published")5 if any(name.endswith(".env") for name in wheel_files):6 problems.append("secret file in wheel")7 return problems or ["ok"]8 9print(ready("0.2.0", ["0.1.0"], ["shopkit/__init__.py"]))10print(ready("0.1.0", ["0.1.0"], ["shopkit/__init__.py", "shopkit/.env"]))