Potential bug on install requirements mutation during dependency resolution

Description

While working on the new resolver support in pip-tools (https://github.com/jazzband/pip-tools/pull/1539) I ran into an issue with failing tests against pip’s main branch. Using git bisect I’ve tracked down a bad commit https://github.com/pypa/pip/commit/0c284520c6d068cb25ac89d9dbee0456c2eba23a which was introduced in https://github.com/pypa/pip/pull/10962.

The main issue with the following line: https://github.com/pypa/pip/blob/0c284520c6d068cb25ac89d9dbee0456c2eba23a/src/pip/_internal/resolution/resolvelib/factory.py#L310

… where template essentially is ireqs[0]: https://github.com/pypa/pip/blob/0c284520c6d068cb25ac89d9dbee0456c2eba23a/src/pip/_internal/resolution/resolvelib/factory.py#L258

See also discussion on the commit.

Expected behavior

I’ve prepared a temporary fix where template is deep copied from ireqs[0] (see https://github.com/pypa/pip/pull/11018) which makes pip-tools’ tests pass. Any ideas on how to avoid ireqs mutation which might lead to potential bugs?

pip version

22.1.dev0

Python version

3.8

OS

macOS

How to Reproduce

Unfortunately, I haven’t found yet simple reproducer other than pip-tools’ tests:

1. git clone https://github.com/atugushev/pip-tools@new-resolver
2. cd pip-tools
3. tox -e py38-pipmain -- -k 'not network'

Output

https://github.com/jazzband/pip-tools/runs/5872141303?check_suite_focus=true

Code of Conduct

• I agree to follow the PSF Code of Conduct.

[pradyunsg]

@atugushev Could you provide a reproducer for the issue?

[pradyunsg]

I’m marking this as a release blocker, or at least, as something we’d want to see tested as part of a beta release before a proper release.