WEBVTT

1
00:00:00.000 --> 00:00:02.479
Part 3 of ML Libraries with a Bot.

2
00:00:02.479 --> 00:00:06.270
Pin Versions and Build Reproducible ML
Environments.

3
00:00:06.270 --> 00:00:11.810
A machine learning project that works
today can break next month without you

4
00:00:11.810 --> 00:00:17.059
changing a line, because a library you
depend on released a new version.

5
00:00:17.059 --> 00:00:23.110
The fix is boring and effective: a virtual
environment per project, and a file that

6
00:00:23.110 --> 00:00:24.568
pins exact versions.

7
00:00:24.568 --> 00:00:30.619
This walkthrough does it with the standard
tools, shows real output, and uses a bot

8
00:00:30.619 --> 00:00:33.098
to explain what you're looking at.

9
00:00:33.917 --> 00:00:36.203
What the bot can and cannot do.

10
00:00:36.203 --> 00:00:42.031
Explain the difference between a loose
requirement like numpy>=2 and a pin like

11
00:00:42.031 --> 00:00:42.990
numpy==2.5.4.

12
00:00:42.990 --> 00:00:46.973
Read a long pip error and tell you which
line matters.

13
00:00:46.973 --> 00:00:50.882
Draft a README section on recreating the
environment.

14
00:00:50.882 --> 00:00:57.004
Know which versions work together today.
pip's resolver and the libraries' own docs

15
00:00:57.004 --> 00:00:57.890
decide that.

16
00:00:57.890 --> 00:01:01.947
See your Python version or platform unless
you tell it.

17
00:01:01.947 --> 00:01:05.340
Make a pip error go away by guessing
versions.

18
00:01:05.340 --> 00:01:09.544
Check each suggestion against the
package's install page.

19
00:01:10.292 --> 00:01:13.078
Pin what works before you upgrade
anything.

20
00:01:13.078 --> 00:01:18.067
Then upgrade one package at a time in a
fresh environment and run your tests.

21
00:01:18.667 --> 00:01:24.527
Python's venv module is part of the
standard library, and the Python Packaging
Guide

22
00:01:24.527 --> 00:01:30.387
recommends virtual environments for
project dependencies: Everything you
install now

23
00:01:30.387 --> 00:01:33.177
goes into .venv, not your system Python.

24
00:01:33.917 --> 00:01:40.451
We installed one pinned package and let
pip pull in its dependencies: The real pip

25
00:01:40.451 --> 00:01:46.985
freeze output from a fresh environment on
our box, with Python 3.13.5: One install

26
00:01:46.985 --> 00:01:49.296
became seven pinned packages.

27
00:01:49.296 --> 00:01:55.910
That's what pip's Repeatable installs page
means when it says a frozen requirements

28
00:01:55.910 --> 00:02:01.966
file pins "not only the top-level
packages, but also all of their transitive

29
00:02:01.966 --> 00:02:03.081
dependencies".

30
00:02:04.000 --> 00:02:07.866
On our box it printed No broken
requirements found.

31
00:02:07.866 --> 00:02:09.913
Run it after every install.

32
00:02:09.913 --> 00:02:14.233
It catches packages whose stated
dependencies aren't met.

33
00:02:14.833 --> 00:02:20.958
To show why version choice matters, we
asked the same environment for an old
NumPy:

34
00:02:20.958 --> 00:02:26.934
It failed. pip found no ready-made wheel
of NumPy 1.x for Python 3.13 on our box,

35
00:02:26.934 --> 00:02:32.616
tried to build it from source, and stopped
because there was no C++ compiler.

36
00:02:32.616 --> 00:02:38.002
The key line from the real output: The
lesson isn't "install a compiler".

37
00:02:38.750 --> 00:02:44.145
The prompt: Here's the full output of a
failed pip install (pasted), my Python

38
00:02:44.145 --> 00:02:45.390
version and my OS.

39
00:02:45.390 --> 00:02:47.534
Which line is the actual cause?

40
00:02:47.534 --> 00:02:52.237
Is it a version mismatch, a missing build
tool or a network problem?

41
00:02:52.237 --> 00:02:56.664
Suggest one change, and tell me which
official page confirms it.

42
00:02:57.333 --> 00:02:59.884
pip freeze doesn't record everything.

43
00:02:59.884 --> 00:03:01.400
Add a short note with:

44
00:03:02.000 --> 00:03:08.034
pip's Repeatable installs page also covers
hash-checking, where each requirement

45
00:03:08.034 --> 00:03:14.295
carries a --hash so a changed download is
refused, and installing with --no-deps so

46
00:03:14.295 --> 00:03:16.331
nothing unlisted sneaks in.

47
00:03:16.331 --> 00:03:19.499
Use them for anything you share or deploy.

48
00:03:20.250 --> 00:03:26.064
The real proof that a requirements file
works is to rebuild from it somewhere
fresh:

49
00:03:26.064 --> 00:03:31.602
If that passes, someone else on the same
Python version and platform can rebuild

50
00:03:31.602 --> 00:03:32.363
your setup.

51
00:03:32.363 --> 00:03:37.970
If it fails, you've found the problem
before a teammate or your future self
does.

52
00:03:38.708 --> 00:03:43.454
When you do want newer versions, upgrade
one package at a time in a fresh

53
00:03:43.454 --> 00:03:47.354
environment, run pip check and your tests,
and freeze again.

54
00:03:47.354 --> 00:03:52.164
Read the package's release notes for
anything marked as a breaking change.

55
00:03:52.164 --> 00:03:57.300
A bot can summarize release notes you
paste in, but it shouldn't decide for you

56
00:03:57.300 --> 00:03:59.770
whether a change matters to your code.

57
00:04:00.500 --> 00:04:02.480
Tested vs documented.

58
00:04:02.480 --> 00:04:10.211
Tested by us: the venv, the freeze output,
pip check and the failed NumPy install,

59
00:04:10.211 --> 00:04:11.625
all on our box.

60
00:04:11.625 --> 00:04:17.847
Documented, not tested by us: hash-
checking mode, from pip's docs.

61
00:04:18.542 --> 00:04:25.999
Tomorrow's three parts start using the
libraries: NumPy and pandas, a first
scikit-

62
00:04:25.999 --> 00:04:29.233
learn model, and PyTorch on the CPU.

63
00:04:29.833 --> 00:04:35.877
Before you run anything: check every bot
answer against the official docs, work in
a

64
00:04:35.877 --> 00:04:41.777
virtual environment, load model files only
from sources you trust, respect dataset

65
00:04:41.777 --> 00:04:47.029
and model licenses, and keep personal data
out of bots and training sets.

66
00:04:47.029 --> 00:04:49.548
Every source is linked on the page.