Extras are optional features published with a package, which users can request when they install it. Dependency groups are named lists in your project file that are not published, meant for your own testing, docs and tooling. Use extras for users and groups for developers.
Definitions
An extra is an optional part of a distribution. In a requirement you list it in square brackets after the package name, such as requests with extras named security and tests, and the installer also pulls in the dependencies those extras list. Multiple extras combine.
A dependency group, defined in PEP 735, is a named list of requirements in a dependency groups table of the project file. The specification says its purpose is to store requirements that are not included in any built distribution of the project.
Side by side
| Extras | Dependency groups | |
|---|---|---|
| Published in package metadata | Yes | No |
| Part of the public interface | Yes | No |
| Installing it also installs the package | Yes | No |
| Works for projects that are not packages | Not meant to | Yes |
| Typical use | Optional features, such as a database driver | Test, docs, lint, typing |
Why this matters for supply chain risk
Extras are visible to everyone who installs your package, so each one widens what a user may pull in. Review them like any other dependency. A group never reaches your users, but it does reach your CI, where secrets live. A compromised test dependency runs in the same job that holds your tokens.
So scan both. Do not assume a development only list is low risk because it is not shipped.
How to decide
- If a user might want it at install time, make it an extra.
- If only your team needs it, make it a group.
- If your project is an application or data project with no package, use groups.
- Keep a single lock that covers every extra and group you use in CI, so the whole set is pinned.
The specification also notes that groups can include other groups, so a combined typing and test group is simple to define.
Environment markers
A requirement can carry a condition after a semicolon, for example to install a Windows only package only on Windows. Markers apply the same way inside extras and groups, so check which platforms your lock covers.
Try it yourself
Click through it at your own pace, or open it full screen. Check whether development components show up in the inventory beside runtime ones.
Quick check
Are dependency groups published to PyPI?
No. The specification says they are not included in any built distribution.
Should I scan test dependencies?
Yes. They run in CI, where credentials are often present.
Safeguard's SBOM scanning can include development components, and you can try a free scan.
Sources
Last reviewed: 19 October 2026.
