County build agents install Python libraries for an assessor geocode utility. Last month an unpinned dependency floated to a breaking release overnight. What should the team do?
Select an answer to reveal the explanation.
Short Explanation
Floating versions are surprise party guests—sometimes they break the build at 2 a.m. Pin the geocode libraries in requirements.txt so county agents get the versions you tested.
Full Explanation
County build agents that install Python libraries for an assessor geocode utility must avoid surprise breaking releases from unpinned dependencies. Pinning dependency versions in requirements.txt locks installs to known-good releases so overnight floats cannot pull a breaking major or incompatible minor into production agents. Removing requirements.txt and installing packages by browsing random blogs destroys reproducibility and invites supply-chain risk. Allowing every package to use the newest major version automatically in production maximizes churn and breakage—the opposite of the needed control after last month's incident. Storing credentials in requirements.txt instead of version pins places secrets in a file often committed to source control and still fails to pin packages. Exam caveat: pinning is necessary but not sufficient—periodically review and upgrade pins in a controlled pipeline with tests; consider hashes, such as pip hash-checking mode, for stronger integrity on municipal agents. Operational check: install from the pinned requirements on a clean agent, run geocode utility tests, attempt a rebuild days later and confirm the same versions resolve, and ensure continuous integration fails if requirements drift without an intentional pin update.