mirror of
https://github.com/mozilla/pdf.js.git
synced 2026-07-14 02:55:49 +02:00
ae179be764
The `requirements.txt` files of the two Python-based builds only listed the top-level dependency, and thus not the full dependency tree, and only limited it via a version range. This means that the actual versions we use for the builds are determined at runtime, and can thus easily change if a new version gets published. This causes the builds to not be deterministic, and it's in contrast to the JavaScript-based builds where `package-lock.json` pins the full dependency tree with fixed versions. This commit changes the `requirements.txt` files to follow the same approach as `package-lock.json` and thus pin the full dependency tree to fixed versions. This ensures deterministic builds, improves consistency and provides better protection against e.g. supply chain attacks by not automatically pulling in new versions as they are published (but rather make updating versions a conscious and verifiable/auditable action). To simplify the update process, and make it repeatable, we document the full one-line generation commands inline.
