Dependency resolution order difference between pip and pipenv

Took me awhile to track down what I was seeing as well as come up with the smallest test example.

So if you have a requirement of pytest-django<2.10 which in it’s setup.py has an install_requires entry of pytest>=2.5. You also have a requirement of pytest<2.10.

Pip on it’s own handles this just fine. Pipenv ends up with the pytest at the current release version.

[test_3-9pMWYqV9][christian@WorkBookPro:~/tmp/test_3]
[18:51:42] $ ll
.
[-rw-r--r-- christian staff     121 Mar 29 18:29]  Pipfile
[-rw-r--r-- christian staff      31 Mar 29 18:51]  req.txt

0 directories, 2 files

[test_3-9pMWYqV9][christian@WorkBookPro:~/tmp/test_3]
[18:51:43] $ cat Pipfile 
[[source]]
url = "https://pypi.python.org/simple"
verify_ssl = true

[packages]
pytest = "<2.10"
pytest-django = "<2.10"

[test_3-9pMWYqV9][christian@WorkBookPro:~/tmp/test_3]
[18:51:44] $ cat req.txt 
pytest<2.10
pytest-django<2.10

[test_3-9pMWYqV9][christian@WorkBookPro:~/tmp/test_3]
[18:51:46] $ pip freeze

[test_3-9pMWYqV9][christian@WorkBookPro:~/tmp/test_3]
[18:52:27] $ pip install -r req.txt
Collecting pytest<2.10 (from -r req.txt (line 1))
  Using cached pytest-2.9.2-py2.py3-none-any.whl
Collecting pytest-django<2.10 (from -r req.txt (line 2))
  Using cached pytest_django-2.9.1-py2.py3-none-any.whl
Collecting py>=1.4.29 (from pytest<2.10->-r req.txt (line 1))
  Using cached py-1.4.33-py2.py3-none-any.whl
Installing collected packages: py, pytest, pytest-django
Successfully installed py-1.4.33 pytest-2.9.2 pytest-django-2.9.1

[test_3-9pMWYqV9][christian@WorkBookPro:~/tmp/test_3]
[18:52:35] $ pip freeze
py==1.4.33
pytest==2.9.2
pytest-django==2.9.1

[test_3-9pMWYqV9][christian@WorkBookPro:~/tmp/test_3]
[18:52:39] $ pip freeze

[test_3-9pMWYqV9][christian@WorkBookPro:~/tmp/test_3]
[18:52:55] $ pipenv install
No package provided, installing all dependencies.
Pipfile found at /Users/christian/tmp/test_3/Pipfile. Considering this to be the project home.
Pipfile.lock not found, creating...
Locking [dev-packages] dependencies...
⠹Locking [packages] dependencies...
⠦Updated Pipfile.lock!
Installing dependencies from Pipfile.lock...
Collecting appdirs==1.4.3 
  Using cached appdirs-1.4.3-py2.py3-none-any.whl
Collecting packaging==16.8 
  Using cached packaging-16.8-py2.py3-none-any.whl
Collecting py==1.4.33 
  Using cached py-1.4.33-py2.py3-none-any.whl
Collecting pyparsing==2.2.0 
  Using cached pyparsing-2.2.0-py2.py3-none-any.whl
Collecting pytest==3.0.7 
  Using cached pytest-3.0.7-py2.py3-none-any.whl
Collecting pytest-django==2.9.1 
  Using cached pytest_django-2.9.1-py2.py3-none-any.whl
Requirement already satisfied: setuptools==34.3.3 in /Users/christian/.virtualenvs/test_3-9pMWYqV9/lib/python3.6/site-packages 
Collecting six==1.10.0 
  Using cached six-1.10.0-py2.py3-none-any.whl
Installing collected packages: appdirs, six, pyparsing, packaging, py, pytest, pytest-django
Successfully installed appdirs-1.4.3 packaging-16.8 py-1.4.33 pyparsing-2.2.0 pytest-3.0.7 pytest-django-2.9.1 six-1.10.0

⠙

[test_3-9pMWYqV9][christian@WorkBookPro:~/tmp/test_3]
[18:53:17] $ pip freeze
appdirs==1.4.3
packaging==16.8
py==1.4.33
pyparsing==2.2.0
pytest==3.0.7
pytest-django==2.9.1
six==1.10.0

[test_3-9pMWYqV9][christian@WorkBookPro:~/tmp/test_3]
[18:53:23] $ 

[c17r]

this is also apparent now that Django has released 1.11. I have Django = "<1.11.0" in my pipfile. Other requirements have as their requirements django, Django, django>=1.8, Django>=1.8. Pipenv will end up installing 1.11 instead of 1.10.7 which is annoying as there are breaking changes.

[kennethreitz]

i think it’s safe to say yes.