Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Version pinning too rigid in setup.py files #201

Closed
mbyrnepr2 opened this issue Nov 29, 2023 · 0 comments
Closed

Version pinning too rigid in setup.py files #201

mbyrnepr2 opened this issue Nov 29, 2023 · 0 comments
Labels
bug Something isn't working

Comments

@mbyrnepr2
Copy link
Contributor

mbyrnepr2 commented Nov 29, 2023

Describe the bug
The fix for this issue should resolve the behaviour we are seeing in this comment..

Currently resc-backend, vcs-scanner and vcs-scraper have pinned to exact version most of their 3rd-party dependencies.
This can cause conflicts when pip tries to resolve them during installation and my environment also requires packages which have different versions of these same packages.

If certain dependencies are undesirable for some reason then they can be excluded as an exception as in the following example, but it's easier for the libraries to be installed successfully if the version requirements are not so strict. Perhaps also a comment would be good to add in order to provide a rationale to future developers when this occurs.
Django>=1.4.2,!=1.5.,!=1.6.

To Reproduce
Create a requirements.txt and have two requirements: resc-backend and celery >5.3.1

ERROR: Cannot install -r .\requirements.txt (line 8) and celery>5.3.1 because these package versions have conflicting dependencies.

The conflict is caused by:
    The user requested celery>5.3.1
    resc-backend 2.0.0 depends on celery==5.3.1

To fix this you could try to:
1. loosen the range of package versions you've specified
2. remove package versions to allow pip attempt to solve the dependency conflict

ERROR: ResolutionImpossible: for help visit https://pip.pypa.io/en/latest/topics/dependency-resolution/#dealing-with-dependency-conflicts

Expected behavior
Allow a range with an optional lower bound. Exclude any versions which are problematic for security reasons, for example.
Otherwise, instead of celery==2.0.0 -> celery

Additional context
Stack overflow.
https://caremad.io/posts/2013/07/setup-vs-requirement/

@mbyrnepr2 mbyrnepr2 added the bug Something isn't working label Nov 29, 2023
@mbyrnepr2 mbyrnepr2 closed this as not planned Won't fix, can't repro, duplicate, stale Nov 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant