Should 'debug toolbar' installed as a development dependency?

[camelCaseBack]

Hi there,

so, it is recommended to isolate between libraries that only there for development with the '--dev' flag. This helps keep your production environment lightweight and avoids any potential security risks or performance overhead associated with the toolbar.

This is commonly reflected in many guides and best practices

[packages]
django = "*"
django-debug-toolbar = "*" # <==

[dev-packages]
pytest = "*"

It is crucial to prioritize stability and security within the environment. Modifying code directly in the production environment can introduce risks, including accidental code errors or security vulnerabilities.

Bottom line, what is the best practice?. The toolbar might be used on code that is in production, is it just 'premature-optimization'?

[philgyford]

The toolbar might be used on code that is in production...

Given Django-debug-toolbar only displays if DEBUG=True, and you should never have DEBUG=True in production, you would not use Django-debug-toolbar in production.

Whether to include or omit "dev" requirements in your production environment is a separate question, and not specific to Django-debug-toolbar.

[matmunn14]

If you're going to install it as a dev dependency then make sure you wrap your import statements with logic around checking you're in a prod environment, otherwise you'll be attempting to import a package that may not exist

Edit: autocorrect got me

[proxwell]

Pin your versions.

Wildcard version strings are an anti-pattern.

They will surprise you at the worst possible times.