18.2-dars: pip va bog'liqliklar

pip install requests               # eng so'nggi mos versiya
pip install requests==2.31.0       # aniq versiya
pip install -r requirements.txt    # fayldan hammasi
pip uninstall requests             # o'chirish
pip list                           # o'rnatilgan paketlar
pip show requests                  # paket haqida (versiya, bog'liqliklar)
pip install --upgrade requests     # yangilash

requests>=2.31,<3.0
flask~=3.0
pandas>=2.0
python-dotenv==1.0.0      # aniq

pip install -r requirements.txt    # hammasini o'rnatadi

pip freeze > requirements.txt

requests==2.31.0
urllib3==2.1.0            # requests ning bog'liqligi ham
certifi==2023.11.17

mening_loyiha
├── requests>=2.31
│   ├── urllib3>=1.21
│   └── certifi
└── flask~=3.0
    └── werkzeug>=3.0

ERROR: Cannot install ... because these package versions have conflicting dependencies

pip install pip-audit
pip-audit                          # ma'lum zaifliklarni tekshiradi

pip install "requests>=2.31,<3.0"       # oralik
pip install requests==2.31.0            # aniq
pip install -r requirements.txt         # fayldan
pip install --upgrade requests          # yangilash
pip freeze > requirements.txt           # qulflash
pip show requests                       # metama'lumot
pip list --outdated                     # eskirgan paketlar
pip-audit                               # xavfsizlik

# requirements.txt
requests>=2.31,<3.0
flask~=3.0
python-dotenv==1.0.0

versiyani belgilang (nomsiz emas): >=2.31,<3.0
~=2.31 — kichik versiyalar, asosiy emas
requirements.txt git'ga; muhit git'ga emas
takrorlanuvchanlik — pip freeze yoki lock fayl
xavfsizlik: nomni tekshiring, pip-audit
yangi asosiy versiya (3.0) — API ni buzishi mumkin

"""SemVer taqqoslash; belgilagichlar ==, >=, ~=, oralik; qaysi versiyalar mos keladi; ~= mantig'i (asosiy versiya cheklanadi)."""

from packaging.specifiers import SpecifierSet
from packaging.version import Version


def main() -> None:
    print("=== 1. Versiya taqqoslash (SemVer) ===")
    print(f"  2.31.0 > 2.20.0: {Version('2.31.0') > Version('2.20.0')}")
    print(f"  2.31.0 > 2.31: {Version('2.31.0') > Version('2.31')}")
    print(f"  3.0 > 2.99: {Version('3.0') > Version('2.99')}")

    print("\n=== 2. Belgilagichlar — qaysi versiyalar mos ===")
    versiyalar = ["2.20.0", "2.31.0", "2.35.0", "3.0.0", "3.1.0"]
    belgilagichlar = ["==2.31.0", ">=2.31", ">=2.31,<3.0", "~=2.31", "!=2.31.0"]
    for belgi in belgilagichlar:
        spec = SpecifierSet(belgi)
        mos = [v for v in versiyalar if Version(v) in spec]
        print(f"  {belgi:15} → {mos}")

    print("\n=== 3. ~= (compatible release) mantig'i ===")
    print(f"  ~=2.31 ≡ >=2.31,<3.0")
    print(f"  2.35 mos: {Version('2.35') in SpecifierSet('~=2.31')}")
    print(f"  3.0 mos: {Version('3.0') in SpecifierSet('~=2.31')}  ← asosiy versiya o'tmaydi")
    print(f"  ~=2.31.1 (patch): 2.31.5 mos {Version('2.31.5') in SpecifierSet('~=2.31.1')}, "
          f"2.32 mos {Version('2.32') in SpecifierSet('~=2.31.1')}")

    print("\n=== 4. SemVer o'zgarish turlari ===")
    ozgarishlar = [
        ("2.31.0", "2.31.1", "PATCH — xato tuzatish, xavfsiz"),
        ("2.31.0", "2.32.0", "KICHIK — yangi imkoniyat, mos"),
        ("2.31.0", "3.0.0", "ASOSIY — moslikni buzishi mumkin"),
    ]
    for eski, yangi, izoh in ozgarishlar:
        print(f"  {eski} → {yangi}: {izoh}")


if __name__ == "__main__":
    main()

=== 1. Versiya taqqoslash (SemVer) ===
  2.31.0 > 2.20.0: True
  2.31.0 > 2.31: False
  3.0 > 2.99: True

=== 2. Belgilagichlar — qaysi versiyalar mos ===
  ==2.31.0        → ['2.31.0']
  >=2.31          → ['2.31.0', '2.35.0', '3.0.0', '3.1.0']
  >=2.31,<3.0     → ['2.31.0', '2.35.0']
  ~=2.31          → ['2.31.0', '2.35.0']
  !=2.31.0        → ['2.20.0', '2.35.0', '3.0.0', '3.1.0']

=== 3. ~= (compatible release) mantig'i ===
  ~=2.31 ≡ >=2.31,<3.0
  2.35 mos: True
  3.0 mos: False  ← asosiy versiya o'tmaydi
  ~=2.31.1 (patch): 2.31.5 mos True, 2.32 mos False

=== 4. SemVer o'zgarish turlari ===
  2.31.0 → 2.31.1: PATCH — xato tuzatish, xavfsiz
  2.31.0 → 2.32.0: KICHIK — yangi imkoniyat, mos
  2.31.0 → 3.0.0: ASOSIY — moslikni buzishi mumkin

"""requirements.txt ni tahlil qilish; Requirement bilan nom, extras, belgilagich ajratish; oraliq vs aniq versiya; bog'liqlik tekshiruvi."""

from packaging.requirements import Requirement
from packaging.specifiers import SpecifierSet
from packaging.version import Version

REQUIREMENTS = """# Loyiha bog'liqliklari
requests>=2.31,<3.0
flask~=3.0
pandas>=2.0
python-dotenv==1.0.0
requests[security]>=2.31          # extras bilan
"""


def main() -> None:
    print("=== 1. requirements.txt ni tahlil qilish ===")
    for qator in REQUIREMENTS.splitlines():
        qator = qator.split("#")[0].strip()
        if not qator:
            continue
        r = Requirement(qator)
        extras = f" extras={r.extras}" if r.extras else ""
        print(f"  {r.name:16} belgilagich: {str(r.specifier) or '(yo`q)':20}{extras}")

    print("\n=== 2. Belgilagich turi ===")
    talablar = ["requests>=2.31,<3.0", "flask~=3.0", "python-dotenv==1.0.0", "pandas"]
    for t in talablar:
        r = Requirement(t)
        if not str(r.specifier):
            tur = "⚠️ versiyasiz (xavfli)"
        elif "==" in str(r.specifier):
            tur = "aniq (qulflangan)"
        else:
            tur = "oraliq (moslashuvchan)"
        print(f"  {r.name:16} {tur}")

    print("\n=== 3. O'rnatilgan versiya mosligini tekshirish ===")
    ornatilgan = {"requests": "2.31.4", "flask": "3.0.1", "pandas": "2.1.0", "python-dotenv": "1.0.0"}
    for qator in REQUIREMENTS.splitlines():
        qator = qator.split("#")[0].strip()
        if not qator:
            continue
        r = Requirement(qator)
        if r.name in ornatilgan:
            versiya = ornatilgan[r.name]
            mos = Version(versiya) in r.specifier if str(r.specifier) else True
            print(f"  {r.name:16} {versiya} {'✅ mos' if mos else '❌ mos emas'} ({r.specifier})")

    print("\n=== 4. Oraliq vs aniq ===")
    print("  oraliq (>=2.31,<3.0): xavfsizlik yangilanishlarini oladi, moslashuvchan")
    print("  aniq (==2.31.4, freeze): to'liq takrorlanuvchanlik")


if __name__ == "__main__":
    main()

=== 1. requirements.txt ni tahlil qilish ===
  requests         belgilagich: <3.0,>=2.31
  flask            belgilagich: ~=3.0
  pandas           belgilagich: >=2.0
  python-dotenv    belgilagich: ==1.0.0
  requests         belgilagich: >=2.31               extras={'security'}

=== 2. Belgilagich turi ===
  requests         oraliq (moslashuvchan)
  flask            oraliq (moslashuvchan)
  python-dotenv    aniq (qulflangan)
  pandas           ⚠️ versiyasiz (xavfli)

=== 3. O'rnatilgan versiya mosligini tekshirish ===
  requests         2.31.4 ✅ mos (<3.0,>=2.31)
  flask            3.0.1 ✅ mos (~=3.0)
  pandas           2.1.0 ✅ mos (>=2.0)
  python-dotenv    1.0.0 ✅ mos (==1.0.0)
  requests         2.31.4 ✅ mos (>=2.31)

=== 4. Oraliq vs aniq ===
  oraliq (>=2.31,<3.0): xavfsizlik yangilanishlarini oladi, moslashuvchan
  aniq (==2.31.4, freeze): to'liq takrorlanuvchanlik

"""virtual muhitda haqiqiy pip: install, list, show; bog'liqliklar; pip freeze; chiqish normallashtiriladi."""

import subprocess
import sys
import tempfile
from pathlib import Path


def main() -> None:
    with tempfile.TemporaryDirectory() as katalog:
        r = Path(katalog)
        muhit = r / ".venv"
        subprocess.run([sys.executable, "-m", "venv", str(muhit)], capture_output=True, text=True)
        bin_papka = "Scripts" if sys.platform == "win32" else "bin"
        py = muhit / bin_papka / ("python.exe" if sys.platform == "win32" else "python")

        print("=== 1. Toza muhitdagi paketlar ===")
        natija = subprocess.run([str(py), "-m", "pip", "list", "--format=freeze"],
                                capture_output=True, text=True)
        paketlar = sorted(q.split("==")[0] for q in natija.stdout.splitlines() if "==" in q)
        print(f"  boshlang'ich paketlar: {paketlar}")

        print("\n=== 2. pip show (mahalliy paket) ===")
        # pip'ning o'zini ko'ramiz (tarmoqsiz)
        natija = subprocess.run([str(py), "-m", "pip", "show", "pip"],
                                capture_output=True, text=True)
        for qator in natija.stdout.splitlines():
            if qator.startswith(("Name:", "Summary:", "Requires:")):
                print(f"  {qator}")

        print("\n=== 3. requirements.txt yozish ===")
        req = r / "requirements.txt"
        req.write_text("# namuna\nrequests>=2.31,<3.0\nflask~=3.0\n", encoding="utf-8")
        print(f"  requirements.txt yaratildi: {req.exists()}")
        for qator in req.read_text(encoding="utf-8").splitlines():
            print(f"    {qator}")

        print("\n=== 4. pip freeze (aniq versiyalar) ===")
        natija = subprocess.run([str(py), "-m", "pip", "freeze"], capture_output=True, text=True)
        freeze_qatorlar = natija.stdout.splitlines()
        print(f"  freeze qatorlari soni: {len(freeze_qatorlar)}")
        print(f"  har qator '==' bilan aniq versiya: {all('==' in q or q.startswith('-') for q in freeze_qatorlar) if freeze_qatorlar else True}")
        print("  ⭐ freeze — aynan o'rnatilgan versiyalar (takrorlanuvchanlik uchun)")


if __name__ == "__main__":
    main()

=== 1. Toza muhitdagi paketlar ===
  boshlang'ich paketlar: ['pip']

=== 2. pip show (mahalliy paket) ===
  Name: pip
  Summary: The PyPA recommended tool for installing Python packages.
  Requires:

=== 3. requirements.txt yozish ===
  requirements.txt yaratildi: True
    # namuna
    requests>=2.31,<3.0
    flask~=3.0

=== 4. pip freeze (aniq versiyalar) ===
  freeze qatorlari soni: 0
  har qator '==' bilan aniq versiya: True
  ⭐ freeze — aynan o'rnatilgan versiyalar (takrorlanuvchanlik uchun)

"""bog'liqlik boshqaruvi: requirements tahlili, versiyasiz yozuvlarni topish, o'rnatilgan mosligini tekshirish, oddiy xavfsizlik auditi (zaif versiyalar ro'yxati)."""

from packaging.requirements import Requirement
from packaging.version import Version

REQUIREMENTS = """requests>=2.31,<3.0
flask~=3.0
pandas
urllib3>=1.26
pyyaml==5.3.1
"""

# O'rnatilgan (pip freeze natijasini soddalashtirilgan)
ORNATILGAN = {
    "requests": "2.31.4",
    "flask": "3.0.1",
    "pandas": "2.1.0",
    "urllib3": "1.26.5",
    "pyyaml": "5.3.1",
}

# Ma'lum zaif versiyalar (soddalashtirilgan namuna — haqiqatda pip-audit qiladi)
ZAIF = {
    "pyyaml": ("<5.4", "CVE-2020-14343: yaml.load bilan RCE"),
    "urllib3": ("<1.26.5", "CVE-2021-33503: ReDoS"),
}


def tekshir(requirements: str) -> dict:
    hisobot = {"versiyasiz": [], "mos_emas": [], "zaif": [], "yaxshi": []}
    for qator in requirements.splitlines():
        qator = qator.split("#")[0].strip()
        if not qator:
            continue
        r = Requirement(qator)
        if not str(r.specifier):
            hisobot["versiyasiz"].append(r.name)
        versiya = ORNATILGAN.get(r.name)
        if versiya and str(r.specifier) and Version(versiya) not in r.specifier:
            hisobot["mos_emas"].append(f"{r.name} {versiya} ∉ {r.specifier}")
        if r.name in ZAIF and versiya:
            shart, tavsif = ZAIF[r.name]
            from packaging.specifiers import SpecifierSet
            if Version(versiya) in SpecifierSet(shart):
                hisobot["zaif"].append(f"{r.name} {versiya}: {tavsif}")
            else:
                hisobot["yaxshi"].append(r.name)
    return hisobot


def main() -> None:
    hisobot = tekshir(REQUIREMENTS)

    print("=== 1. ⚠️ Versiyasiz bog'liqliklar (xavfli) ===")
    for nom in hisobot["versiyasiz"]:
        print(f"  ❌ {nom} — versiya belgilanmagan, kutilmagan yangilanish xavfi")
        print(f"     tavsiya: {nom}>=<joriy>,<keyingi-asosiy>")

    print("\n=== 2. Mos kelmaydigan versiyalar ===")
    if hisobot["mos_emas"]:
        for m in hisobot["mos_emas"]:
            print(f"  ❌ {m}")
    else:
        print("  ✅ barcha o'rnatilgan versiyalar belgilagichga mos")

    print("\n=== 3. ⚠️ Xavfsizlik auditi ===")
    for z in hisobot["zaif"]:
        print(f"  🔴 {z}")
    print("  ⭐ haqiqiy loyihada: pip-audit bu tekshiruvni avtomatik qiladi")

    print("\n=== 4. Tavsiyalar ===")
    print("  1. Har bog'liqlikka versiya oralig'i belgilang (>=X,<keyingi-asosiy)")
    print("  2. pip freeze bilan aniq versiyalarni qulflang (takrorlanuvchanlik)")
    print("  3. pip-audit bilan muntazam xavfsizlik tekshiruvi")
    print("  4. Yangilanishlarni sinab, keyin qabul qiling")


if __name__ == "__main__":
    main()

=== 1. ⚠️ Versiyasiz bog'liqliklar (xavfli) ===
  ❌ pandas — versiya belgilanmagan, kutilmagan yangilanish xavfi
     tavsiya: pandas>=<joriy>,<keyingi-asosiy>

=== 2. Mos kelmaydigan versiyalar ===
  ✅ barcha o'rnatilgan versiyalar belgilagichga mos

=== 3. ⚠️ Xavfsizlik auditi ===
  🔴 pyyaml 5.3.1: CVE-2020-14343: yaml.load bilan RCE
  ⭐ haqiqiy loyihada: pip-audit bu tekshiruvni avtomatik qiladi

=== 4. Tavsiyalar ===
  1. Har bog'liqlikka versiya oralig'i belgilang (>=X,<keyingi-asosiy)
  2. pip freeze bilan aniq versiyalarni qulflang (takrorlanuvchanlik)
  3. pip-audit bilan muntazam xavfsizlik tekshiruvi
  4. Yangilanishlarni sinab, keyin qabul qiling

requests                            # ❌ kutilmagan yangilanish
requests>=2.31,<3.0                 # ✅ oraliq

pandas>=2.0                         # ⚠️ 3.0 API ni buzishi mumkin
pandas>=2.0,<3.0                    # ✅

pip install requests               # ❌ requirements.txt yangilanmaydi
pip install requests && pip freeze > requirements.txt   # ✅

pip install requests               # ❌ tizimga
source .venv/bin/activate && pip install requests   # ✅

pip install "a" "b"                 # ❌ ERROR: conflicting dependencies
# ✅ mos versiyalarni toping yoki bittasini o'zgartiring

pip install reqeusts               # ❌ zararli paket bo'lishi mumkin
pip install requests               # ✅ nomni tekshiring

# eski, zaif versiyalar bilan ishlash   # ❌
pip-audit                          # ✅ muntazam tekshiring

from packaging.version import Version
from packaging.specifiers import SpecifierSet
1.  print(Version("2.31.0") > Version("2.9.0"))
2.  print(Version("2.31.0") in SpecifierSet("==2.31.0"))
3.  print(Version("2.35") in SpecifierSet(">=2.31,<3.0"))
4.  print(Version("3.0") in SpecifierSet(">=2.31,<3.0"))
5.  print(Version("2.35") in SpecifierSet("~=2.31"))
6.  print(Version("3.0") in SpecifierSet("~=2.31"))
7.  print(Version("2.31.1") in SpecifierSet("~=2.31.0"))
8.  print(Version("2.32") in SpecifierSet("~=2.31.0"))
9.  print(Version("2.31.0") in SpecifierSet("!=2.31.0"))
10. print(Version("1.0.0") > Version("1.0"))
11. print(Version("2.0.0rc1") < Version("2.0.0"))
12. print(len([v for v in ["1.0", "2.0", "3.0"] if Version(v) in SpecifierSet(">=2.0")]))

1.  # requirements.txt:
    requests
    flask
    pandas

2.  # requirements.txt:
    pandas>=2.0

3.  # loyihani ko'chirdik:
    # faqat kod, requirements.txt yo'q

4.  # o'rnatish:
    pip install reqeusts

5.  # eski loyiha:
    pyyaml==5.3.1        # ma'lum zaiflik bor