Pin Dependencies or Break in Production: The Hash-Pinning Standard

July 11, 2026 · Kryptorious Tools

A requirements.txt that says requests>=2.0 does not describe a build. It describes a range of possible builds that depend on the clock, the mirror, and whatever shipped that morning. For anything you deploy, that is a silent liability.

The failure mode

Version ranges resolve at install time. Two engineers running the same file three days apart can get different transitive trees if a sub-dependency released a new minor in between. Same inputs, different outputs — the definition of a non-reproducible build. When a bug appears, "works on my machine" becomes literally true and completely useless.

The fix: hash-pinned requirements

pip supports hash-checking mode. A line like requests==2.31.0 --hash=sha256:... makes pip refuse the package unless the downloaded artifact's hash matches. A compromised release fails closed instead of shipping.

Without the busywork

• pip-tools (pip-compile) locks transitive deps to exact versions with hashes.
• pip-audit scans a locked environment against the PyPI vulnerability database (verified live: pypi.org/pypi/pip-audit/json returns HTTP 200).

Wire both into CI and a green build means: exact versions, verified hashes, zero known-vulnerable pins.

← Back to Kryptorious Tools Blog

← All posts