How to Evaluate the Quality of Python Packages

Installing packages with Python is just one pip install command away. That’s one of the many great qualities that the Python ecosystem has to offer.

However, you may have downloaded a third-party package once that didn’t work out for you in one way or another. For example, the package didn’t support the Python version that you were using in your project, or the package didn’t do what you expected it to do.

By understanding the characteristics of a high-quality Python package, you can avoid introducing incompatible or even harmful code into your project. In this tutorial, you’ll learn how the Python Package Index can give you a first impression of a package. Then you’ll dig even deeper by checking out Libraries.io, the GitHub repository, and the license of any Python package that you want to use.

In the end, you’ll know how to evaluate third-party packages that you can find online before you implement them into your Python projects.

For future reference, you can also download this handy flowchart that’ll help you decide if a third-party Python package works for your particular situation:

Bonus Download: Click here to download the free flowchart that you can use to evaluate the quality of Python packages.

How to Evaluate the Quality of Third-Party Python Packages

The Python Package Index (PyPI) provides the largest collection of external Python packages. Before you install a package with pip, you should make sure that it’s available on PyPI:

Being able to find the package on PyPI is a good indicator that it’s legit, although you still need to be careful about what you’re getting.

Note: It’s possible to pip install a package from a Git repository or directly install a Python wheel you find online.

While you can download a Python package from anywhere, you should ask yourself if the package is high-quality and safe.

On PyPI, you’ve got the option to either browse categories or search for keywords. Unless you’re looking for a very niche package, chances are that PyPI will present you with a list of thousands of packages that match your topic.

To sort the order of the list, PyPI gives you two options:

Relevance
Date last updated

The option to sort by Relevance is ambiguous because you don’t know what PyPI takes into consideration for this order. Still, when you sort by relevance, the packages appearing on top are indeed often the ones that suit your needs:

Sometimes, it can be tricky to find the right package on PyPI, even if you know the package’s name. For example, when you search for beautiful soup, then you’ll get a number of similar-looking results. That’s when Relevance can come in handy.

Out of curiosity, you may also peek into the packages that have been updated lately by using the Date last updated order. But usually the sorting makes irrelevant packages appear on top, just because they were updated recently.

In most cases, a package doesn’t need to be cutting-edge unless it addresses a security issue. Instead, it’s important that a package supports the Python version of your project. This is when the PyPI filter comes into play:

For example, when you want to use the cool new features of Python 3.11 to full capacity, then you can select Python 3.11 in the list of Programming Languages filters.

Additionally, you can combine filters on PyPI. It’s a good idea to also add Development Status into your consideration by filtering for Production/Stable, too. This way, you increase the chances of working with reliable packages that have gone through thorough testing.

When you’ve found a package that seems to fit your needs, then it’s time to put it under the microscope to make sure it’s safe and reliable. For this evaluation, you’ll study the PyPI details page. Clicking a package name brings you to a page that’s dedicated to the package:

On the PyPI details page of a package, you’ll find the most important information about a package:

Project description
Supported Python versions
Release history
Project links
GitHub statistics
License information
Author details

Depending on the Python project that you need to add the package to, some pieces of information may be more important than others. However, you should always make sure that the project description is mature. Ideally, you get a helpful introduction to the package and find steps on how to get started with the package, as well as some code examples.

Note: Any third-party package worth considering should have a project link to the project’s source code. It’s also a good indicator of the maturity of a package when online documentation and even a project website exist.

Another proxy indicator of the quality of a package can be its author. You may prefer to use a package from a known figure in the Python community rather than one by an anonymous person with an account named something like asdf123. When you hover over the author’s name, then you can verify that the email address of the package’s author is valid:

On the sidebar of a package’s detail package, you find statistics about the package next to the author’s details. Most prominent are the GitHub statistics, which you’ll investigate in a moment. It’s a little hidden, but you also find a link to another platform that gives you valuable information about the quality of external Python packages. You’ll have a look at this platform next.

Remove ads

Leverage Libraries.io

On the PyPI details page of a package, you can find a link to view the project’s statistics on Libraries.io. If you’re looking for high-quality Python packages, then the mission of Libraries.io will be music to your ears:

Helping developers make faster, more informed decisions about the software that they use. (Source)

But it’s not only Python developers who profit from their objective. Libraries.io keeps track of packages in multiple programming languages, including JavaScript and Java.

When you follow the link from the PyPI details page to Libraries.io, you see a page that looks similar to the PyPI details page at first glance:

If you have a closer look at a Libraries.io details page, then you can find valuable information about a package that PyPI doesn’t show. Although the statistics come from PyPI, you’d need to access the PyPI API dataset to retrieve the data.

On Libraries.io, you see other valuable data points, such as:

Dependent packages
First release
Contributors

If the first release of a package is years in the past, but the package is still in development, then it probably aged well. This especially holds true when many contributors have joined forces to build the package.

Developing a package that becomes a requirement for others is a badge of honor for anyone who publishes a package on PyPI. A high number of dependent packages shows you that other developers trust the package. For their packages to work correctly, they rely on having the package in question installed.

On Libraries.io, you can find another interesting benchmark for the quality of third-party Python packages: the SourceRank. SourceRank is the proprietary score that Libraries.io gives packages based on several metrics. Having a look at the metrics gives you another checklist that you can take into consideration when evaluating Python packages:

The SourceRank breakdown for the folium package shows you that it’s a package that you can trust. It had a recent release, it’s not brand-new, and over a hundred packages use it as a dependency, although it hasn’t reached version 1.0 yet.

On the SourceRank list, you see some factors listed that you already saw on PyPI. Many of them refer to the Git repository where the source code of the package is hosted. So that’s the next guidepost to have a closer look at.

Explore the GitHub Repository

The GitHub repository of a third-party package shows you how active its development is. You can dig into the repository to explore the source code yourself or browse through the issues to see how other developers use the package.

If you’ve got time on your hands, then diving into the source code is a great way to evaluate the quality of a Python package. Reading other people’s Python code also helps in your Python learning journey.

But the reason why you want to use an external package might be that you’re not knowledgeable in this particular area. That’s why the social proof of a Python package comes in handy. On GitHub, you can spot how excited others are about a project. Some of the metrics are the number of:

Watchers: People who have chosen to receive notifications about a repository’s activity
Stars: A way for users to bookmark or like a repository to keep track of it
Forks: Copies of a repository that someone has created in order to make changes without affecting the original codebase
Pull requests: Proposed changes to a repository that a contributor has submitted for review and potential merging into the main codebase
Issues: A way for users to report problems or suggest new features for a repository, which contributors or maintainers can then address

A high number of watchers and stars means that other people are interested in the Git repository. The number of forks indicates how many developers have copied the package’s repository to play around with the source code. In most open-source projects, other developers write their contributions to a package inside their own forks.

A high number of pull requests means that many developers want to contribute to a project. That’s a good indicator. But looking at the numbers alone usually doesn’t give you the full picture: