Secure Modern and Simple Dependency Management with PDM and Friends
summary
Explains how imports resolve on disk and why virtual environments and Python versions matter, compares pip, poetry and PDM as namespace managers, shows PDM commands like pdm add and pdm sync to produce reproducible lockfiles, demonstrates real packages (Rich, aiohttp) with transitive dependencies and version constraints, warns about PyPI typosquats (example Xbox Live Pi) and supply‑chain risks, recommends pyenv/venv isolation, lockfile syncing, and running safety scans to detect known vulnerabilities.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:40Speaker background
- 3:45Overview of PDM
- 4:50Python basics and imports
- 6:35Dependency management
- 9:15Security implications
- 11:20Tools for isolation
- 14:43Understanding packages
- 17:17Module search path
- 20:43PDM workflows
- 23:43Conclusion
related talks
26mDependency Management in Python
52mManaging Dependencies in Python with Poetry
36mPipenv: The Future of Python Dependency Management
24mPipenv: New Package Dependency Management System for Python
34mSecure Python Development: Tips, Tricks, and Tools
30mThe Evolutionary Saga of Python Packaging
28mPyenv + Poetry: how to manage your Python environments simply
33mVirtual Environments and Dependency Management in Python