Exclude a specific package

[waghanza]

Hello,

I need to freeze my requirements to make some immutable environments. pipdeptree seems the way to go.

However, I am not sure of how to exclude some dependencies from this freeze.

I meaan I use hatch on development, then pipdeptree -f shows me hatch and all its dependancies.

But my freeze file will be use to check for CVEs in my app, so I do not want to check CVEs in hatch and all its dependencies.

Any ideas ?

Regards,

[kemzeb]

To exclude some packages from the output, you may use the -e/--exclude option. Its a comma-separated list that can also accept wildcards e.g.:

pipdeptree -f --exclude virtualenv,setuptools,pytest*

[waghanza]

But seems not to exclude sub-dependencies

[kemzeb]

Yes, you would need to explicitly pass the direct and non-direct dependencies of these packages when using --exclude, though I wouldn't mind introducing something like this.

It may not be good to change the behavior of --exclude since there could be people who want the freedom to be explicit about what packages they wish to exclude. I see a couple of approaches right now:

1. Introduce something like --exclude-dependencies, which would be a comma-separated list of packages where pipdeptree would handle excluding the package's direct/non-direct dependencies from the output. This would work with the previous --exclude option which defines packages without excluding their dependencies.
2. Have --exclude-dependencies as just a flag, where if set it would exclude the dependencies from packages defined in --exclude. Users who for whatever reason want to both exclude specific packages and also have packages where they wish to just exclude their dependencies as well won't be able to do so with this approach.

The only workaround I see to this is passing the packages and its dependencies to --exclude. I'm not sure how you are calling pipdeptree, but you could get these dependencies by doing the following:

pipdeptree -p hatch,another-package -a -d 0
# This returns hatch, another-package, and all of their direct/non-direct dependencies

You would need to remove the version specifiers from the output (e.g. by using some string manipulation program like cut or through programmatic means)

[waghanza]

I think that --exclude-dependencies flag is a way better solution. I mean, in case of dependency A is a dependency of B and C, and we want to exclude B (so not C) we want to keep dependency A, but not B only dependencies.

I mean their is a logic we can not handle with a set of bash commands