The standard library is large, but most real projects also use third-party packages — libraries published by other developers on PyPI, the Python Package Index (over half a million of them).

pip is the tool that installs them.

Note: these lessons run Python inside your browser, which has no terminal and no package installer. The commands below are ones you run on your own computer — read them, try them locally, and come back. Everything in Modules 8 and 10 will name the packages it needs.

Installing

pip install requests

That downloads requests from PyPI along with anything it depends on. Then use it like any other module:

import requests

Some systems need pip3, or the more reliable form that guarantees you're using the pip belonging to the Python you're running:

python -m pip install requests

Everyday commands

| Command | Does | | --- | --- | | pip install name | install the latest version | | pip install name==2.31.0 | install one exact version | | pip install --upgrade name | upgrade to the latest | | pip uninstall name | remove it | | pip list | show everything installed | | pip show name | details about one package | | pip freeze | installed packages in requirements.txt format |

Packages worth knowing

| Package | For | | --- | --- | | requests | HTTP requests — Module 8 | | beautifulsoup4 | parsing HTML — Module 8 | | pytest | testing — Module 9 | | pandas | data analysis | | flask, django | web applications | | pillow | image processing |

Before you install

A package is someone else's code running on your machine, so a little care pays off:

• Check the name carefully. Typo-squatting is real — attackers publish reqeusts hoping you slip. Copy names from official documentation, don't type from memory.
• Look at the project. PyPI links to the source repository. Recent commits, open issues being answered, and a real download count are all good signs.
• Prefer the standard library when it already does the job. You don't need a package to parse JSON or read a CSV.
• Watch the dependency count. Every package you add brings its own dependencies, and all of them become your problem to keep updated.

Version numbers

Most packages follow semantic versioning, MAJOR.MINOR.PATCH:

• PATCH (2.31.0 → 2.31.1) — bug fixes, safe
• MINOR (2.31.0 → 2.32.0) — new features, still backwards-compatible
• PATCH/MINOR are safe upgrades; MAJOR (2.x → 3.0) may break your code deliberately

That's why pinning versions matters, which is lesson 7.6.

Try it yourself

You can't install packages in the browser, but you can ask Python whether a module is importable at all. Standard library modules always are; anything from PyPI is not until you pip install it locally.

Checkpoint

• PyPI hosts third-party packages; pip install name fetches them.
• Prefer python -m pip install so you install into the right Python.
• pip list, pip show, pip freeze inspect what you have.
• Check names carefully — typo-squatting is a real attack.
• Semantic versioning: PATCH and MINOR are safe, MAJOR can break things.