A practical process for managing Python dependencies, vulnerability alerts, lockfiles, upgrade risk and software supply-chain evidence in production services.
Pin reproducible builds, know why every dependency exists and treat upgrades as tested production changes rather than housekeeping.
Make builds reproducible
Loose version ranges make it difficult to reproduce what was deployed and can introduce an unrelated change during an emergency rebuild. Use a lockfile or equivalent resolved dependency record and build from it consistently in CI and release environments.
Record the runtime, operating system and package source assumptions too. A secure Python package can still depend on a vulnerable system library or a base image that has not been maintained.
Triage alerts by exposure
Not every advisory has the same consequence for your service. Establish whether the vulnerable path is present, reachable and meaningful in the deployed configuration before choosing urgency, while still respecting vendor guidance.
Do not suppress an alert with a comment alone. Record the reason, compensating control, owner and review date so accepted risk does not become invisible technical debt.
Upgrade with evidence
Separate routine dependency updates into small reviewable changes where possible. Run tests, static checks and build verification, then observe error and latency signals after release for libraries that affect networking, serialization, authentication or database behaviour.
Remove packages that no longer serve a runtime purpose. Each unused dependency enlarges the update surface and makes incident triage more ambiguous.
Evidence to take into review
- Production builds use a resolved dependency set.
- Dependencies have a documented runtime purpose.
- Security findings are triaged with owner and review date.
- Upgrades receive automated and production evidence.
- Unused packages and stale base images are removed.
Explore all engineering notes.
Use PRODUCTION-7 to connect this concern with the other dimensions of a trustworthy backend.
View all articles Get the checklist