DEV Community

Mikhail
Mikhail

Posted on

I asked an AI about a duplicate dependency. It made up a whole backstory.

#ai #programming #python #reviews

Cleaning up a pyproject.toml last week and noticed both dotenv and python-dotenv in there. Figured one was leftover cruft, asked an AI which one to drop.

It gave me a pretty confident answer: package used to be called dotenv, got renamed to python-dotenv at some point, and the old name was kept around as an empty stub for backwards compat. Sounded reasonable enough, that kind of rename happens in the Python ecosystem all the time.

Went to actually check before touching the dependency file though. Not what happened.

Turns out they're two completely separate packages from two different authors. dotenv has existed on its own since 2013. In 2025 its author just republished it as a deprecated stub pointing at python-dotenv, probably to reduce confusion for people who install the wrong one. No renaming, no shared history, nothing documented anywhere that matches the story I got.

Checked the wheel contents to confirm:

$ unzip -l dotenv-0.9.9-py2.py3-none-any.whl
Archive:  dotenv-0.9.9-py2.py3-none-any.whl
  Length      Date    Time    Name
---------  ---------- -----   ----
      123  2025-02-19 22:15   dotenv-0.9.9.dist-info/METADATA
       21  2025-02-19 22:15   dotenv-0.9.9.dist-info/WHEEL
     1071  2025-02-19 22:15   dotenv-0.9.9.dist-info/LICENSE
      ...
Enter fullscreen mode Exit fullscreen mode

Zero .py files. Just dist-info metadata. And the METADATA file literally says:

Summary: Deprecated package
Requires-Dist: python-dotenv

Dates and authors on PyPI don't line up with a renaming story either - different people, different timelines, no continuity.

Out of curiosity I also pulled numbers from pypistats: dotenv still gets around 10.5M downloads a month, python-dotenv gets 786M. So something like 1-2% of that traffic is still hitting the old stub, probably from old requirements.txt files nobody's touched in years or tutorials that never got updated.

None of this is a huge deal on its own, pip install dotenv still works fine because it just pulls the real package as a dependency. But if I'd taken the "renamed package" explanation at face value, I'd have written that history down somewhere as fact, and it's just not true. The answer sounded exactly as confident as a correct one would have.

Top comments (0)