Python: Please stop screwing over Linux distros
&gt; pin their dependencies to 10 versions and 6 vulnerabilities ago<p>That is the real problem IMHO. Most python users like to pin dependencies so that &quot;their program don&#x27;t break&quot;, and that&#x27;s also the reason why so much effort is put in what they call &quot;correct&quot; dependency resolution resulting in the creation of new python package managers that all do &quot;more correct&quot; dependency resolution and make programs &quot;break less&quot; and at the same time require less efforts from the maintainers to actually maintain their code by doing dependency upgrades. And then one day you want to upgrade a dependency and you realize you&#x27;re 10 releases behind on 10 dependencies, and what was supposed to be a quick maintenance task is now 100 maintenance task.<p>If you don&#x27;t pin, your program will break one day or another, a user might open an issue with the traceback, or, your program will break directly in CI where you will see the traceback. Upgrade it, or contribute to the dependency, but just go ahead and fix it, instead of being defensive and trying to have dependency resolution that &quot;doesn&#x27;t break&quot;. At the same time you&#x27;ll be adopting the actual practice of &quot;Continuous Integration&quot;, of your dependencies, which has a better cost&#x2F;benefit ratio.<p>I always avoid pinning dependencies, I try to make pip just install the latest version of everything, I am willing to contribute upgrade fixes to any Python package I use, but some dependencies do pin which breaks my own aggressive Continuous Integration practice, heck, I&#x27;d even need an option for pip to ignore version resolution at all so that I can make all my contributions to upgrade everything I use. I even remember when I had CI test matrix with all combinations of versions of everything, I don&#x27;t do that anymore, I just support the latest of everything, we can always have the latest python with containers anyway so that&#x27;s not even a blocker anymore. If you&#x27;re not a &quot;techbro using containers&quot;, it&#x27;d be fine too because you should then be able to make your distro packages at any point in time and expect all of them to work together, minus the delta of the handful of upgrades that are pending to release here and there.