notatallshaw/nab

Nab is an experimental Python tool that solves a common headache in software development: figuring out exactly which version of every package a project needs, so it runs the same way for everyone. You give it your project's dependency list, declared in a pyproject.toml file, and it resolves the full tree of requirements, including all the packages that your direct dependencies themselves depend on, then writes a lockfile that pins every version exactly. Nab does not install packages itself, it just produces the lockfile, and you hand that to whichever installer you prefer. The resolver is based on an algorithm called PubGrub, designed to find a consistent set of package versions that satisfies all constraints at once and to produce helpful error messages when no such set exists. The project's goal is to reach resolver performance similar to uv, another popular Python package tool, while keeping its own implementation written in Python. Nab takes a security conscious approach by default. It tries to extract package metadata without executing any code. If that is not possible, it can build packages to read their metadata, but restricts this to only your own local packages by default, not remote ones. Git dependencies must point to a specific commit rather than a floating branch name, unless you turn that restriction off yourself. The repo also exposes three standalone libraries, nab-resolver, nab-python, and nab-index, that other tools can use to build on the same resolver or index access logic. All are marked experimental and their APIs may change before the project reaches its 0.1.0 release. Installation is meant to happen through a tool manager such as pipx or uv, rather than as a regular project dependency, which keeps it isolated from the packages it is resolving.