Python dependency management is critical for secure and maintainable applications. This guide covers package management tools, reproducible builds, and security practices for Python developers. 

pip vs poetry 

 
pip 

pip is Python's standard package installer and the most widely used tool in the Python ecosystem. It installs packages from PyPI directly via command line (pip install package_name) or from requirements.txt files. IBM Open Enterprise SDK for Python includes pip by default, making it the most accessible option for Python developers. 

Poetry 

Poetry combines package management, virtual environments, and project scaffolding. It uses pyproject.toml and generates poetry.lock files for deterministic builds. Poetry has better dependency resolution than pip and simplifies PyPI publishing. However, Poetry requires a separate installation process.  

For detailed installation instructions, follow the official Poetry installation guide 

 
Custom Package Installation Strategies  

While pip and poetry typically install packages from public repositories such as PyPI, enterprise environments often have additional requirements. Some systems may have limited or no internet connectivity, making direct installation from PyPI impractical. In other cases, organizations may restrict access to public package repositories to prevent the installation of unapproved dependencies. To address these requirements, you can adopt alternative package installation strategies such as offline package installation and a private package repository.  

Installing Python packages without internet connection 

This process involves five steps: 

1. Download dependencies: Check the target package's pyproject.toml or setup.py for required dependencies. Note that dependencies may have their own dependencies. 

2. Download distributions: Get wheel files (.whl) or archive files (.tar.gz or .zip) from GitHub releases/tags or PyPI for both the target package and all dependencies. 

3. Transfer files: Move all downloaded archives to the target machine. 

4. Build dependencies: Install dependencies first using pip install <dependency archive file>. Install them in dependency order.

     Note: wheel files (.whl) can be installed directly, while source distributions require building. 

5. Build target package: Install the target package with pip install <target archive file>. Use --no-build-isolation if the package looks for already-installed dependencies. 

For detailed step-by-step instructions with examples, see this guide on installing Python packages without internet connection

Using Private Package Repositories 

Instead of manual installation, you can configure pip to use private package repositories such as Nexus or Artifactory. This approach provides better package management for enterprise environments. 

Configure pip to use a private repository by: 

• Setting the index URL: pip install --index-url https://your-private-repo.com/simple/ package_name
• Using pip configuration file (`pip.conf` or `pip.ini`):

  [global] 
index-url = https://your-private-repo.com/simple/
trusted-host = your-private-repo.com 

For z/OS, IBM provides the AI Toolkit repository.  

Example: 
pip3 install --index-url https://downloads.pyaitoolkit.ibm.net:443/repository/python_ai_toolkit_zos/simple --trusted-host downloads.pyaitoolkit.ibm.net pillow 

Importing modules: PYTHONPATH Guidance 

PYTHONPATH is an environment variable that adds directories to Python's module search path. It adds directories to sys.path for importing modules, useful for development testing or system-wide package availability without installation. However, it can create multiple unexpected problems such as errors in importing modules, version conflicts and reduced reproducibility.  

Therefore, It is not recommended to use PYTHONPATH.  

Instead: 

• Use PATH or LIBPATH environment variables for configuration 

• Utilize virtual environments (venv) when available 

If you must use PYTHONPATH: 

• Use for development/testing only, not production 

• Document PYTHONPATH requirements clearly 

Security Best Practices 

Security Risks & Stability Risks 

Managing Python dependencies involves balancing two primary concerns: security risks from vulnerable packages and stability risks from unexpected changes. Security risks arise when dependencies contain known vulnerabilities that attackers can exploit. Stability risks occur when dependency updates introduce breaking changes or incompatibilities that disrupt application functionality. 

Security Risks - Keep Dependencies Updated 

Outdated dependencies are a primary security risk. CVE vulnerabilities are publicly disclosed, and attackers actively scan for vulnerable versions. Delayed updates create security debt that increases risk over time. 

How to keep dependencies updated: 

• Regular security audits: Schedule weekly or monthly dependency reviews 

• Automated scanning tools: Use pip-audit to detect known vulnerabilities 

• Subscribe to security advisories: Monitor security announcements for packages you use 

Scanning for Vulnerabilities with pip-audit 

pip-audit is a tool provided by the Python Packaging Authority (PyPA) for scanning Python dependencies for known vulnerabilities. It checks if your installed packages or dependency files (such as requirements.txt)  contain versions that are affected by publicly disclosed security vulnerabilities.  

Scan your current environment: 

pip-audit 

Scan a requirements file: 

pip-audit –requirement requirements.txt 

Automatically fix vulnerabilities: 

pip-audit --fix 

Stability Risks - Pin Dependency Versions 

Pinning dependency versions ensures reproducible builds across environments and prevents surprise breakages from automatic updates. Instead of using loose version constraints like Flask>=2.3.0, pin exact versions like Flask==2.3.0. This guarantees that the same package versions are installed every time, eliminating version conflict issues. Use pip freeze > requirements.txt to capture a complete snapshot of all installed packages with exact versions.  

requirements.txt vs Lock Files 

requirements.txt is pip's traditional dependency specification format. It typically lists only direct dependencies, while pip resolves and installs transitive dependencies automatically during installation. However, without strict version pinning, it does not guarantee reproducible builds over time.  

Lock files such as poetry.lock and requirements.txt generated by pip-tools solve these limitations. They record the full dependency tree, including both direct and transitive dependencies, with exact version pinning. This ensures that every installation is reproducible and consistent across different machines.  

# install pip-tools  
python3 -m venv venv  
. ./venv/bin/activate 
pip install pip-tools 


# Create requirements.in 
# cat requirements.in 
Requests > 2.34.0 

# Generate lock file 
pip-compile requirements.in 

# cat requirements.txt 
certifi==2026.5.20 
 # via requests 
charset-normalizer==3.4.7 
 # via requests 
idna==3.18 
 # via requests 
requests==2.34.2 
 # via -r requirements.in 
urllib3==2.7.0 
 # via request

Python dependency management balances reproducibility, security and maintainability. Choose appropriate tools: pip for simplicity or Poetry for modern features. Implement reproducible builds with lock files and version pinning. Maintain security through regular scanning and updates to successfully manage your application and project. 

Want to learn more about using Python on z/OS? Visit our Python Portal for a convenient way to access more resources.