{"action":"created","issue":{"url":"https://api.github.com/repos/projectcalico/calico/issues/1013","repository_url":"https://api.github.com/repos/projectcalico/calico","labels_url":"https://api.github.com/repos/projectcalico/calico/issues/1013/labels{/name}","comments_url":"https://api.github.com/repos/projectcalico/calico/issues/1013/comments","events_url":"https://api.github.com/repos/projectcalico/calico/issues/1013/events","html_url":"https://github.com/projectcalico/calico/issues/1013","id":152663076,"number":1013,"title":"Felix doesn't appear to pin all its dependencies","user":{"login":"tomdee","id":6635,"avatar_url":"https://avatars.githubusercontent.com/u/6635?v=3","gravatar_id":"","url":"https://api.github.com/users/tomdee","html_url":"https://github.com/tomdee","followers_url":"https://api.github.com/users/tomdee/followers","following_url":"https://api.github.com/users/tomdee/following{/other_user}","gists_url":"https://api.github.com/users/tomdee/gists{/gist_id}","starred_url":"https://api.github.com/users/tomdee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tomdee/subscriptions","organizations_url":"https://api.github.com/users/tomdee/orgs","repos_url":"https://api.github.com/users/tomdee/repos","events_url":"https://api.github.com/users/tomdee/events{/privacy}","received_events_url":"https://api.github.com/users/tomdee/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-02T22:46:13Z","updated_at":"2016-05-11T17:14:43Z","closed_at":null,"body":"e.g. in https://github.com/projectcalico/calico/blob/master/felix_requirements.txt only a few deps are pinned.\r\n\r\nI like the approach used in libcalico, with a `-frozen` file which pins everything (https://github.com/projectcalico/libcalico/blob/master/build-requirements-frozen.txt) and a non-frozen file (https://github.com/projectcalico/libcalico/blob/master/build-requirements.txt) which only lists direct dependencies. This makes it easy to upgrade deps in future."},"comment":{"url":"https://api.github.com/repos/projectcalico/calico/issues/comments/218526860","html_url":"https://github.com/projectcalico/calico/issues/1013#issuecomment-218526860","issue_url":"https://api.github.com/repos/projectcalico/calico/issues/1013","id":218526860,"user":{"login":"matthewdupre","id":9053570,"avatar_url":"https://avatars.githubusercontent.com/u/9053570?v=3","gravatar_id":"","url":"https://api.github.com/users/matthewdupre","html_url":"https://github.com/matthewdupre","followers_url":"https://api.github.com/users/matthewdupre/followers","following_url":"https://api.github.com/users/matthewdupre/following{/other_user}","gists_url":"https://api.github.com/users/matthewdupre/gists{/gist_id}","starred_url":"https://api.github.com/users/matthewdupre/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matthewdupre/subscriptions","organizations_url":"https://api.github.com/users/matthewdupre/orgs","repos_url":"https://api.github.com/users/matthewdupre/repos","events_url":"https://api.github.com/users/matthewdupre/events{/privacy}","received_events_url":"https://api.github.com/users/matthewdupre/received_events","type":"User","site_admin":false},"created_at":"2016-05-11T17:14:42Z","updated_at":"2016-05-11T17:14:42Z","body":"I think I prefer keeping them open ended for Felix: bear in mind that Felix is often not installed inside a virtualenv or container, so it needs to be able to co-exist with other packages that might want later versions.  If we pin them all, either the pin is a lie and we use different versions when installing from packages or we start distributing debs and rpms for a bunch of python modules.\r\n\r\n@tomdee?"}}