"Don't add Django to install_requires" item

[danlamanna]

Thanks for this repo, this is a really useful checklist.

There's an item which is "Don't add Django to install_requires" - I was wondering what the rationale behind this was? After looking at many popular django packages the consensus seems to be the opposite.

[fjsj]

Hi @danlamanna , the reason is to avoid a forced Django upgrade when you upgrade the app. A while ago django-filter, which we consider a good benchmark, for example didn't use install_requires. Looks like they updated this in Jul 13, 2018 (merge date): https://github.com/carltongibson/django-filter/pull/846

I personally lean towards not using install_requires. A couple of times I've found myself not being able to upgrade Django, but needing to upgrade a Django app, even when the new app version didn't support my old Django version. So I upgraded the app, kept the old Django app, and added some workaround to make the app backwards compatible.

Could you provide other benchmarks, i.e., well-known currently maintained Django apps that use install_requires? If the current pattern is to use it, we'll update the checklist. Thanks!

[danlamanna]

Thanks for the quick response! It seems like this is a question of library requirements versus application requirements. I tend to think libraries should have abstract requirements and applications (not to be confused with django apps) should have concrete dependencies in the form of a lock file (requirements.txt typically). FWIW, this is the article I formed much of my opinion from https://caremad.io/posts/2013/07/setup-vs-requirement/.

Picking the top 3 starred packages I could find for django, they appear to all include django in install_requires:

• https://github.com/encode/django-rest-framework/blob/master/setup.py
• https://github.com/jazzband/django-debug-toolbar/blob/master/setup.py
• https://github.com/pennersr/django-allauth/blob/master/setup.py

[fjsj]

Thanks @danlamanna This was recently changed in DRF, check discussion: https://github.com/encode/django-rest-framework/pull/7063

But if the big folks are doing it, we should do it as well! I'll leave the issue open and someone will work on it. Please feel free to make a PR if you wish.