Editing pip dependencies

Pin a sealed version in requirements.txt, including transitive overrides via direct pinning.

Direct dependencies

The pip manifest is requirements.txt. Replace the version specifier with the sealed version:

-requests==2.31.0
+requests==2.31.0+sp1

Python and JVM-style ecosystems use + as the sealed-version separator. See Naming & versioning conventions for the full per-ecosystem suffix table.

Run pip install -r requirements.txt; the resolved version is the sealed counterpart pulled through pypi.sealsecurity.io.

Transitive dependencies (pin as direct)

pip does not have a dedicated transitive-override syntax. The mechanism is to add the transitive package as a direct dependency in requirements.txt, pinned to the sealed version. pip's resolver treats the pinned entry as authoritative, so any depending package that asks for the same name gets the sealed version too.

 # Existing direct dependencies
 some-framework==4.5.0

+# Pin a transitive to the sealed version
+urllib3==2.0.7+sp1

The pinned line does not have to be near the dependency that brings the transitive in; pip resolves everything together.

If you use constraints.txt (passed via pip install -c constraints.txt) for project-wide version constraints, the same pinning works there.

Related

• Configuring pip: the package-manager setup that points pip at the Seal Artifact Server.

• Editing Poetry dependencies: the Poetry equivalent in the same ecosystem.