So, it's great that now has the standard lock file format specified in PEP 751. And it's great that a bunch of tools can now produce that format.

But what about *consuming* it? Specifically, I'm looking at pip's documentation and I see an explanation of how to generate a pylock.toml file, but nothing which indicates pip could then install from that file. Can it? If so, what's the right combination of arguments?

And to head off the million and one posts this will generate: yes, I have heard about uv. I still want to know about pip, and that's my business and not yours, and if you just reply with a content-free advertisement for uv I'll block you.

0

If you have a fediverse account, you can quote this note from your own instance. Search https://infosec.exchange/users/ubernostrum/statuses/114831903014577488 on your instance and quote it. (Note that quoting is not supported in Mastodon.)