Going Beyond requirements.txt With pylock.toml and PEP 751

<p>What is the best way to record the Python dependencies for the reproducibility of your projects? What advantages will lock files provide for those projects? This week on the show, we welcome back Python Core Developer Brett Cannon to discuss his journey to bring PEP 751 and the pylock.toml file format to the community.</p>
<p>Brett has been working on a way to move beyond the <code>requirements.txt</code> file for over six years. He was on the show previously to discuss his work on PEP 665, which was rejected. He decided to continue to push forward, authoring PEP 751 last year, which was accepted at the end of March this year.</p>
<p>The PEP calls for a new file format to record your project’s dependencies. The goal was to have a standardized immutable record for what should be installed to reproduce your project in a virtual environment. He discusses working with other packaging projects and the compromises involved in creating a standard.</p>
<div class="alert alert-primary" role="alert">
<p><strong>Course Spotlight:</strong> <a href="realpython.com/courses/python-subprocess-modul… the Python subprocess Module</a> </p>
<p>In this video course, you’ll learn how to use Python’s subprocess module to run and control external programs from your scripts. You’ll start with launching basic processes and progress to interacting with them as they execute.</p>
</div>
<p>Topics:</p>
<ul>
<li>00:00:00 – Introduction</li>
<li>00:02:38 – Brett’s roles within the Python community</li>
<li>00:05:41 – How to move beyond requirement.txt?</li>
<li>00:10:58 – What does the community use as project artifacts?</li>
<li>00:15:28 – Building on the success of pyproject.toml</li>
<li>00:17:44 – Introducing PEP 665</li>
<li>00:19:49 – Software Bills of Materials and security</li>
<li>00:25:20 – Back to lock files and security</li>
<li>00:31:08 – Video Course Spotlight</li>
<li>00:32:27 – Not giving up on the idea</li>
<li>00:34:01 – Leading into PEP 751</li>
<li>00:38:54 – Working toward a single multi-platform file</li>
<li>00:43:02 – The final push</li>
<li>00:48:54 – Leaving room for flexibility</li>
<li>00:53:50 – And it’s done, PEP 751 accepted unconditionally</li>
<li>00:58:06 – Keynote speaker at EuroPython 2025</li>
<li>00:58:45 – What are uv workspaces?</li>
<li>01:01:02 – Considering the use of lock files in data science</li>
<li>01:05:23 – Updates about Python for WASI and Emscripten</li>
<li>01:13:51 – Clarification on WASI </li>
<li>01:20:28 – Future conversation about Python launcher</li>
<li>01:23:04 – What are you excited about in the world of Python?</li>
<li>01:24:25 – What do you want to learn next?</li>
<li>01:28:41 – What’s the best way to follow your work online?</li>
<li>01:31:00 – Thanks and goodbye</li>
</ul>
<p>Show Links:</p>
<ul>
<li><a href="snarky.ca/">Tall, Snarky Canadian</a></li>
<li><a href="youtube.com/watch?v=wgxBHuUOmjA">BREAK…: Guido van Rossum Returns as Python’s BDFL - YouTube</a></li>
<li><a href="packaging.python.org/en/latest/">Python Packaging User Guide</a></li>
<li><a href="peps.python.org/pep-0751/">PEP 751 – A file format to record Python dependencies for installation reproducibility</a></li>
<li><a href="peps.python.org/pep-0665/#file-format">… 665 – A file format to list Python dependencies for reproducibility of an application</a></li>
<li><a href="packaging.python.org/en/latest/specifications/… Specification - Python Packaging User Guide</a></li>
<li><a href="packaging.python.org/en/latest/specifications/… script metadata - Python Packaging User Guide</a></li>
<li><a href="peps.python.org/pep-0723/">PEP 723 – Inline script metadata</a></li>
<li><a href="docs.astral.sh/uv/concepts/projects/workspaces… workspaces - uv</a></li>
<li><a href="youtube.com/watch?v=UTduy7Qkvk8">Do you have a flag? - Eddie Izzard - YouTube</a></li>
<li><a href="openmathlib.org/OpenBLAS/">OpenBLAS : An optimized BLAS library</a></li>
<li><a href="ep2025.europython.eu/">EuroPython 2025 - July 14 to 20, 2025 - Prague, Czech Republic & Remote</a></li>
<li><a href="bytecodealliance.org/">Bytecode Alliance</a></li>
<li><a href="bytecodealliance.zulipchat.com/">Recent conversations - Bytecode Alliance - Zulip</a></li>
<li><a href="snarky.ca/my-impressions-of-gleam/">My impressions of Gleam</a></li>
<li><a href="snarky.ca/my-impressions-of-rescript/">… impressions of ReScript</a></li>
<li><a href="exercism.org/tracks/python">Python on Exercism</a></li>
<li><a href="letterboxd.com/nothingbutsnark/films/">… Cannon’s Films - Letterboxd</a></li>
<li><a href="opensource.snarky.ca/About+Me/Media+I+Like&quo… I Like - Open Source by Brett Cannon</a></li>
<li><a href="bsky.app/profile/snarky.ca">Brett Cannon (@snarky.ca) — Bluesky</a></li>
<li><a href="fosstodon.org/@brettcannon">Brett Cannon (@brettcannon@fosstodon.org) - Fosstodon</a></li>
</ul>
<p>Level up your Python skills with our expert-led courses:</p>
<ul>
<li><a href="realpython.com/courses/packaging-with-pyprojec… Project Packaging With pyproject.toml</a></li>
<li><a href="realpython.com/courses/basics-exercises-instal… Basics Exercises: Installing Packages With pip</a></li>
<li><a href="realpython.com/courses/python-subprocess-modul… the Python subprocess Module</a></li>
</ul> <p><a rel="payment" href="realpython.com/join">Support the podcast & join our community of Pythonistas</a></p>