{"action":"created","issue":{"url":"https://api.github.com/repos/django-nose/django-nose/issues/239","labels_url":"https://api.github.com/repos/django-nose/django-nose/issues/239/labels{/name}","comments_url":"https://api.github.com/repos/django-nose/django-nose/issues/239/comments","events_url":"https://api.github.com/repos/django-nose/django-nose/issues/239/events","html_url":"https://github.com/django-nose/django-nose/issues/239","id":112812104,"number":239,"title":"Listing django in install_requires can cause upgrades to upgrade Django","user":{"login":"jsocol","id":180459,"avatar_url":"https://avatars.githubusercontent.com/u/180459?v=3","gravatar_id":"","url":"https://api.github.com/users/jsocol","html_url":"https://github.com/jsocol","followers_url":"https://api.github.com/users/jsocol/followers","following_url":"https://api.github.com/users/jsocol/following{/other_user}","gists_url":"https://api.github.com/users/jsocol/gists{/gist_id}","starred_url":"https://api.github.com/users/jsocol/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsocol/subscriptions","organizations_url":"https://api.github.com/users/jsocol/orgs","repos_url":"https://api.github.com/users/jsocol/repos","events_url":"https://api.github.com/users/jsocol/events{/privacy}","received_events_url":"https://api.github.com/users/jsocol/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/django-nose/django-nose/labels/bug","name":"bug","color":"e11d21"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/django-nose/django-nose/milestones/8","html_url":"https://github.com/django-nose/django-nose/milestones/v1.4.3","labels_url":"https://api.github.com/repos/django-nose/django-nose/milestones/8/labels","id":1342805,"number":8,"title":"v1.4.3","description":"Goals:\r\n* Django 1.9 support\r\n* Handle Django-style arguments with options (``--verbosity 2`` rather than ``--verbosity=2``)\r\n* More REUSE_DB=1 fixes\r\n\r\n","creator":{"login":"jwhitlock","id":286017,"avatar_url":"https://avatars.githubusercontent.com/u/286017?v=3","gravatar_id":"","url":"https://api.github.com/users/jwhitlock","html_url":"https://github.com/jwhitlock","followers_url":"https://api.github.com/users/jwhitlock/followers","following_url":"https://api.github.com/users/jwhitlock/following{/other_user}","gists_url":"https://api.github.com/users/jwhitlock/gists{/gist_id}","starred_url":"https://api.github.com/users/jwhitlock/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jwhitlock/subscriptions","organizations_url":"https://api.github.com/users/jwhitlock/orgs","repos_url":"https://api.github.com/users/jwhitlock/repos","events_url":"https://api.github.com/users/jwhitlock/events{/privacy}","received_events_url":"https://api.github.com/users/jwhitlock/received_events","type":"User","site_admin":false},"open_issues":5,"closed_issues":1,"state":"open","created_at":"2015-10-07T14:19:18Z","updated_at":"2015-11-05T02:13:18Z","due_on":"2015-11-17T06:00:00Z","closed_at":null},"comments":6,"created_at":"2015-10-22T14:13:13Z","updated_at":"2015-11-30T15:41:15Z","closed_at":null,"body":"With Django 1.7.10 installed, I ran:\r\n\r\n```bash\r\npip install -U django-nose\r\n```\r\n\r\nand it also updated Django to 1.8.5 because it's in `install_requires` in `setup.py`. This seems logical, but can have serious unintended consequences, which is why I usually avoid listing Django itself as an actual install dependency."},"comment":{"url":"https://api.github.com/repos/django-nose/django-nose/issues/comments/160664740","html_url":"https://github.com/django-nose/django-nose/issues/239#issuecomment-160664740","issue_url":"https://api.github.com/repos/django-nose/django-nose/issues/239","id":160664740,"user":{"login":"jwhitlock","id":286017,"avatar_url":"https://avatars.githubusercontent.com/u/286017?v=3","gravatar_id":"","url":"https://api.github.com/users/jwhitlock","html_url":"https://github.com/jwhitlock","followers_url":"https://api.github.com/users/jwhitlock/followers","following_url":"https://api.github.com/users/jwhitlock/following{/other_user}","gists_url":"https://api.github.com/users/jwhitlock/gists{/gist_id}","starred_url":"https://api.github.com/users/jwhitlock/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jwhitlock/subscriptions","organizations_url":"https://api.github.com/users/jwhitlock/orgs","repos_url":"https://api.github.com/users/jwhitlock/repos","events_url":"https://api.github.com/users/jwhitlock/events{/privacy}","received_events_url":"https://api.github.com/users/jwhitlock/received_events","type":"User","site_admin":false},"created_at":"2015-11-30T15:41:15Z","updated_at":"2015-11-30T15:41:15Z","body":"@jgoettsch yes, best practice is to pin the version in requirements.txt.  Soon, pip will support cryptographic hashes of packages, and I expect best practices in 2016 to be 1) include the hashes, and 2) include all dependencies of your package as well.\r\n\r\nI have a similar workflow to @jsocol's when updating packages, but I try to keep up with the latest everything, so it looks more like:\r\n\r\n```\r\ncat requirements.txt | cut -d= -f1 | xargs -n1 pip install -U\r\n```\r\n\r\nI can see how this would be super annoying if you were forced to stay on an old version of Django.\r\n\r\nI think dropping Django from the install requirements has very few downsides, and it's on the roadmap for the next version.  It's also not my itch, so I'm hoping that someone will submit a PR."}}