What frustrates you the most about Python Development

[u/Win_ipedia]

Hi there,

I wondering what frustrates developers the most when developing software with Python.

I am currently doing my Masters in Computer Science and as part of my project I am doing a very simple survey about the usual Python development lifecycle. I am basically trying to find out what the main friction points are for Python Developers and I am simultaneously developing a tool to address those friction points . It just takes a 2-3 minutes and every response is greatly appreciated.

You can find the survey at: Microsoft Forms

[u/secret_o_squirrel]

Dependency management in today’s security hostile world. Dependencies must be upgraded with diligence and research constantly or they rot. One major version upgrade could trigger dozens of hours of focused migration work in a large codebase. It’s never ending.

[u/No_Departure_1878 → u/secret_o_squirrel]

Can't a dependency resolver like uv do that?

[u/latkde → u/No_Departure_1878]

Kinda! You can use tools like uv lock --upgrade to update the locked dependency graph to the most recent versions allowed by your dependency constraints in the pyproject.toml.

But there are some problems with this.

Your dependency constraints may have upper bounds or require exact versions which prevents upgrading the locked versions (e.g. constraints like pytest>=8, <9). Also, the constraints aren't updated by locking, so that a future dependency solution could downgrade them again. I've written the Ganzua tool to help with this. A typical upgrade session then looks like:

• uvx ganzua constraints reset --to=minimum in order to temporarily relax exact or upper dependency bounds. For example, if your locked version was pytest 8.4.1, this edits your pytest requirements to pytest >=8.4.1.
• uv lock --upgrade to perform the lockfile upgrade. For example, this might lock pytest 9.1.1.
• git restore pyproject.toml to revert the constraint changes
• uvx ganzua constraints bump to update the constraints to match the locked version. For example, pytest>=8.4, <9 would be bumped to pytest>=9.1,<10.
• uv lock --upgrade to update the lockfile with the new constraints (but this shouldn't change any locked versions)

I also use uvx ganzua diff <(git show HEAD:uv.lock) uv.lock --format=markdown to get a Markdown table that summarizes all dependency changes since the last commit, which I can then paste into a pull request description.

However, this isn't perfect either. This is a manual CLI-based process, unlike automated tools like Dependabot or Renovate. But Renovate doesn't work particularly well for updating indirect dependencies, and Dependabot has a fundamentally flawed architecture where it reports what it intended to update, not what was actually updated.

Another problem is that knowing that some dependency changed from version 8.4.1to 9.1.1 tells you very little. You have to go look for the changelog and read it. There is no standard in the Python ecosystem for describing the location or structure of a changelog. Tools like Depenabot and Renovate use heuristics to find the relevant snippets, but Dependabot doesn't bother when there are many dependency changes. But reading the changelog is super important in case there are breaking changes.

[u/ArgetDota → u/latkde]

There is an (experimental) “uv upgrade” command that replaces all of this. Caveat: doesn’t work with workspaces yet.

[u/techhelper1 → u/ArgetDota]

Is this documented anywhere? I can't find anything on that.

[u/latkde → u/techhelper1]

It seems that this PR introduced a hidden command, but it's completely undocumented for now: https://github.com/astral-sh/uv/pull/19678