How pipreqs cut a Python project's requirements.txt from 214 packages to 23

·1 views

A software team discovered their Python project's requirements.txt had ballooned to 214 packages, most of which the codebase never actually used, because pip freeze snapshots everything installed in an environment regardless of real imports. The bloated file slowed Docker builds, triggered false vulnerability alerts, and left developers too afraid to remove any dependency. The team switched to pipreqs, a tool that statically scans Python source files and lists only the packages the code actually imports. After running pipreqs, the requirements file shrank to just 23 packages, eliminating noise and restoring confidence in the project's dependency list. The episode highlights a key distinction: pip freeze answers what is installed, while pipreqs answers what the code genuinely needs.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Android developers get updates to ConstraintLayout, Firebase, Intercom, and Auth0 SDKs

Four widely used Android dependencies have received new releases: ConstraintLayout 2.2.2 delivers a binary compatibility fix as the library enters maintenance mode in favor of Compose. Firebase's updated Bill of Materials (34.17.0) bundles fixes across multiple libraries, including auth timeout corrections, Firestore chunked caching for large documents, and improved Crashlytics crash reporting on Android API 37+. Intercom SDK 18.6.0 introduces pinch-and-zoom for image attachments, resolves an ANR caused by thread-blocking during initialization, and fixes keyboard overlap issues in Canvas Kit sheets. Auth0 4.0.1 builds on the 4.0.0 major release, which raised the minimum SDK to API 31, removed PasskeyProvider and redundant credential manager constructors, and added SSO deserialization support along with ephemeral session handling for Chrome Custom Tabs. Developers using Intercom should also note that the next major version will require Kotlin 2.0 or higher for binary compatibility.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Journeymen fixes three pipeline bugs affecting job visibility and reliability

Developer grading platform Journeymen identified and resolved three backend bugs in its analysis pipeline this week. One issue caused stuck repository analysis runs to appear identical to slow ones on the developer dashboard, which was addressed by adding explicit progress-stage tracking. A second bug involved a Lambda worker timing out on larger repositories, causing jobs to silently never complete until the slow code path was identified and fixed. A third problem saw failed jobs landing in an SQS dead-letter queue with no alerts or in-product visibility, which has now been wired up for observability. The company shared the update publicly, noting that its core promise of verified over self-reported results must apply to its own infrastructure as well.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

React Hooks Explained: How useRef and useMemo Improve App Performance

The React Mastery Series continues with a deep dive into two widely used hooks: useRef and useMemo. useRef allows developers to store values that persist across renders without triggering component re-renders, making it useful for accessing DOM elements, tracking previous values, and managing timers or WebSocket connections. Unlike useState, changes to a useRef value are not tracked by React and do not cause UI updates. useMemo optimizes performance by memoizing the result of expensive calculations, recomputing only when specified dependencies change. Together, these hooks help developers build more efficient and responsive React applications in production environments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer finds Uniswap v3 TVL overstated by up to 25x due to virtual reserve bug

A software developer discovered a critical bug in their paid DEX data API that caused Uniswap v3 total value locked (TVL) figures to be overstated by as much as 25 times the actual amount. The error stemmed from using virtual reserves — mathematical constructs that describe liquidity curve shape — instead of real token balances held by the pool contract. For example, one WETH/USDC pool on Base was reported at $2.84 billion TVL when actual on-chain balances showed roughly $111 million. The developer has since corrected the implementation to separately report real custody balances for TVL and virtual reserves for trade depth calculations. The incident also highlighted the inadequacy of basic API response-shape testing, prompting the addition of magnitude checks and cross-source validation.

0 comments Read more at DEV Community