Hello dynamic dependencies, my old friends

[Preocts]

Remember this and how excitedly I just chattered away in the pull request?

9b12424

Yeah, okay, about that. After blinding following one of the first guides on pip-tools I found years ago, I came to the understanding that there was a better way. Reading through a different write-up I saw the light. Then, like the egg I am, I took the authors advice full bait and tackle without pausing to think: "Why would I put --constraint constraints.txt in the requirements files? I just assumed this was the way. Well, here I am. Nothing but myself and the consequences of my own actions once again.

Hard linking the constraint flag in the requirements files seems like a great idea. Why doesn't the pyproject.toml support that? The simple reason that I can see, after slapping my face into it at high speeds, is that you do not want to hard pin your dependencies for a library. Pretty obvious, right?

So we come full circle. The requirements*.txt files are just the libraries used in the package. They are dynamically linked in the pyproject.toml so that everything builds nice and neatly. As a library package there are no pins other than the constraints of the consuming project. As a deployment artifact, maybe in a docker, the install can reference the constraints and you have controlled versions. That's the job of nox and just altering the build session to handle a different style of building.

---

Yes, the dev and test optional-dependencies should be the new dependency groups. We'll get there. Once pip-tools supports dependency groups (a PR is on the table now).