Python · The language, not just syntax
How do modern Python packaging and dependency management work?
Short answer
Modern projects declare metadata and dependencies in pyproject.toml, build wheels or sdists with a PEP 517 backend, and install with pip or uv. Lock files pin the full resolved graph for reproducibility.
pyproject.toml is the standard place for build configuration, project metadata and tool settings. The build-system table names the backend, and the project table declares name, version, requires-python and dependencies.
[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"
[project]
name = "billing-service"
version = "1.4.0"
requires-python = ">=3.11"
dependencies = [
"fastapi>=0.110,<1.0",
"sqlalchemy>=2.0,<3.0",
]What to pin and what to lock
- Pin direct dependencies with sensible ranges to receive security patches
- Lock the full transitive graph for applications that need reproducible deploys
- Publish libraries with ranges, not exact versions, so consumers can resolve
- Use hashes and a private index when supply-chain integrity matters
Dependency resolution is not trivial. Conflicting constraints can force pip to backtrack for a long time, and an unpinned transitive dependency can change behaviour between builds. Tools such as uv, Poetry and pip-tools produce lock files that record exact versions across the graph.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1What is the difference between a wheel and an sdist?
- 2Why lock transitive dependencies for an application but not a library?
- 3What does the build-system table in pyproject.toml control?
- 4How would you handle a private package index?
Say it in the interview
Modern packaging centres on pyproject.toml, which declares metadata, dependencies and the build backend. Applications should lock the full transitive graph for reproducible deploys, while libraries should publish compatible version ranges. I prefer wheels for fast installs, pin conservatively for security updates, and use hashes or a private index when supply-chain risk matters.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Python mock interview and get scored feedback on depth, clarity and confidence.