Existing version constraints do not constrain new installs

Issue description

If you specify a dependency version constraint when installing a dependency then dependencies installed after that point will ignore that constraint which causes dependency resolution failures.

Expected result

If I lock a dependency in the Pipfile to a specific version then any new installs should perform dependency resolution with that in mind.

Actual result

When performing an unbound install of a module it will default to the latest version even if that is incompatible with existing locked dependencies in the pipfile.

Steps to replicate

pipenv --python 3.8.0 install llvmlite==0.26.0
pipenv install fastparquet -v

This also occurs with python 3.7.4

---

$ pipenv --support

Pipenv version: '2018.11.26'

Pipenv location: '/home/matthew/.local/pipx/venvs/pipenv/lib/python3.7/site-packages/pipenv'

Python location: '/home/matthew/.local/pipx/venvs/pipenv/bin/python'

Python installations found:

• 3.8.0: /home/matthew/.pyenv/versions/3.8.0/bin/python3.8
• 3.7.4: /home/matthew/.pyenv/versions/3.7.4/bin/python3.7m
• 3.7.4: /home/matthew/.pyenv/versions/3.7.4/bin/python3.7
• 3.7.3: /home/matthew/Programming/Python/anaconda3/bin/python3.7m
• 3.6.8: /usr/bin/python3.6m
• 3.6.8: /usr/bin/python3.6
• 3.5.6: /home/matthew/.pyenv/versions/3.5.6/bin/python3.5
• 3.5.6: /home/matthew/.pyenv/versions/3.5.6/bin/python3.5m
• 3.5.2: /usr/bin/python3.5
• 3.5.2: /usr/bin/python3.5m
• 2.7.15: /usr/bin/python2

PEP 508 Information:

{'implementation_name': 'cpython',
 'implementation_version': '3.7.4',
 'os_name': 'posix',
 'platform_machine': 'x86_64',
 'platform_python_implementation': 'CPython',
 'platform_release': '4.15.0-46-generic',
 'platform_system': 'Linux',
 'platform_version': '#49-Ubuntu SMP Wed Feb 6 09:33:07 UTC 2019',
 'python_full_version': '3.7.4',
 'python_version': '3.7',
 'sys_platform': 'linux'}

System environment variables:

• COLORTERM
• DBUS_SESSION_BUS_ADDRESS
• DEFAULTS_PATH
• DESKTOP_SESSION
• DISPLAY
• GDMSESSION
• GLADE_CATALOG_PATH
• GLADE_MODULE_PATH
• GLADE_PIXMAP_PATH
• GNOME_TERMINAL_SCREEN
• GNOME_TERMINAL_SERVICE
• GTK2_MODULES
• GTK_MODULES
• HOME
• JAVA_HOME
• LANG
• LANGUAGE
• LOGNAME
• MANDATORY_PATH
• PATH
• POWERLINE_COMMAND
• PWD
• QT_ACCESSIBILITY
• QT_QPA_PLATFORMTHEME
• SESSION_MANAGER
• SHELL
• SHLVL
• SSH_AGENT_PID
• SSH_AUTH_SOCK
• S_COLORS
• TERM
• TMUX
• TMUX_PANE
• TMUX_PLUGIN_MANAGER_PATH
• USER
• USERNAME
• VTE_VERSION
• WINDOWPATH
• XAUTHORITY
• XDG_CONFIG_DIRS
• XDG_CURRENT_DESKTOP
• XDG_DATA_DIRS
• XDG_MENU_PREFIX
• XDG_RUNTIME_DIR
• XDG_SEAT
• XDG_SESSION_DESKTOP
• XDG_SESSION_ID
• XDG_SESSION_TYPE
• XDG_VTNR
• OLDPWD
• ZSH
• DOTFILES
• PAGER
• LESS
• LSCOLORS
• LS_COLORS
• PYENV_SHELL
• KEYTIMEOUT
• VISUAL
• EDITOR
• SVN_EDITOR
• GIT_EDITOR
• UBUNTU_MENUPROXY
• FZF_DEFAULT_OPTS
• FZF_DEFAULT_COMMAND
• ANTIBODY_HOME
• AWS_ACCESS_KEY_ID
• AWS_SECRET_ACCESS_KEY
• ZSH_AUTOSUGGEST_HIGHLIGHT_STYLE
• SDKMAN_DIR
• SDKMAN_PLATFORM
• SDKMAN_VERSION
• SDKMAN_CANDIDATES_API
• SDKMAN_CANDIDATES_DIR
• GRADLE_HOME
• ARTIFACTORY_USERNAME
• ARTIFACTORY_PASSWORD
• PIP_NO_INPUT
• LC_ALL
• DEFAULT_USER
• PIP_REQUIRE_VIRTUALENV
• VIRTUAL_ENV_DISABLE_PROMPT
• CONDA_HOME
• CONDA_EXE
• _CE_M
• _CE_CONDA
• CONDA_PYTHON_EXE
• CONDA_SHLVL
• CONDA_PREFIX
• CONDA_DEFAULT_ENV
• CONDA_PROMPT_MODIFIER
• _
• PIP_DISABLE_PIP_VERSION_CHECK
• PYTHONDONTWRITEBYTECODE
• PIP_SHIMS_BASE_MODULE
• PIP_PYTHON_PATH
• PYTHONFINDER_IGNORE_UNSUPPORTED

Pipenv–specific environment variables:

Debug–specific environment variables:

• PATH: /home/matthew/Programming/Python/anaconda3/bin:/home/matthew/Programming/Python/anaconda3/condabin:/home/matthew/.cargo/bin:/home/matthew/.sdkman/candidates/gradle/current/bin:/home/matthew/.antibody/git-AT-github.com-COLON-BrandwatchLtd-SLASH-aws-credentials.git:/home/matthew/.pyenv/shims:/home/matthew/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/home/matthew/.pyenv/bin:/home/matthew/.gem/ruby/2.3.0/bin:/home/matthew/.gem/ruby/2.5.0/bin:/home/matthew/.antibody/https-COLON--SLASH--SLASH-gitlab.com-SLASH-matthewfranglen-SLASH-docker-go/bin:/home/matthew/.antibody/https-COLON--SLASH--SLASH-gitlab.com-SLASH-matthewfranglen-SLASH-format-python:/home/matthew/.antibody/https-COLON--SLASH--SLASH-gitlab.com-SLASH-matthewfranglen-SLASH-git-stashes:/home/matthew/.antibody/https-COLON--SLASH--SLASH-gitlab.com-SLASH-matthewfranglen-SLASH-random:/home/matthew/.antibody/https-COLON--SLASH--SLASH-github.com-SLASH-matthewfranglen-SLASH-gitflow-avh:/home/matthew/Programming/Shell/vityman-r/bin:/home/matthew/Programming/Scala/spark-binaries/current/bin:/home/matthew/Programming/Shell/terraform:/home/matthew/Programming/Shell/packer:/home/matthew/.fzf/bin
• SHELL: /bin/zsh
• EDITOR: vim
• LANG: en_GB.UTF-8
• PWD: /home/matthew/test/example-pipenv

---

Contents of Pipfile (‘/home/matthew/test/example-pipenv/Pipfile’):

[[source]]
name = "pypi"
url = "https://pypi.org/simple"
verify_ssl = true

[dev-packages]

[packages]
llvmlite = "==0.26.0"
fastparquet = "*"

[requires]
python_version = "3.8"

Contents of Pipfile.lock (‘/home/matthew/test/example-pipenv/Pipfile.lock’):

{
    "_meta": {
        "hash": {
            "sha256": "cfe4d6a43a0541d32161be36e4c44c5e37a13f0dc98efe89eb541c01ba69437f"
        },
        "pipfile-spec": 6,
        "requires": {
            "python_version": "3.8"
        },
        "sources": [
            {
                "name": "pypi",
                "url": "https://pypi.org/simple",
                "verify_ssl": true
            }
        ]
    },
    "default": {
        "enum34": {
            "hashes": [
                "sha256:2d81cbbe0e73112bdfe6ef8576f2238f2ba27dd0d55752a776c41d38b7da2850",
                "sha256:644837f692e5f550741432dd3f223bbb9852018674981b1664e5dc339387588a",
                "sha256:6bd0f6ad48ec2aa117d3d141940d484deccda84d4fcd884f5c3d93c23ecd8c79",
                "sha256:8ad8c4783bf61ded74527bffb48ed9b54166685e4230386a9ed9b1279e2df5b1"
            ],
            "version": "==1.1.6"
        },
        "llvmlite": {
            "hashes": [
                "sha256:02ef5d4070693f9bd5cc849ba281fffeecd74a0e774e685741992a2e184e28bd",
                "sha256:0468ebf4b4161c076e8fce07a313405034bd11abc7133947b647fd0a8059efa6",
                "sha256:13e84fe6ebb0667233074b429fd44955f309dead3161ec89d9169145dbad2ebf",
                "sha256:1d28e0f10ac4222bd79a83914d2efc03e8d8d79b1c7246c83f30f66465c8963c",
                "sha256:1db76486373ed11df98f8641bcd95fe78e80aaef2e351013032bf33828067d11",
                "sha256:2438499c6a4c120b8562dc2a0376055ff6f3685cb0ea24a6e01e0991483ba974",
                "sha256:24e7ba80a4dc4aa89d6f0062928d1b3dd4c6c3ff137d76909f57b89972b673ca",
                "sha256:3554a558e5977bdbbc172c13b4055f24cb985f85557205fb44e231e96eeaddeb",
                "sha256:4648e1511a2095ea0b1f43f624348f1fcc73d33581d3f7fdbfea6ead2ca05dba",
                "sha256:6bec9380dec3f56ab7f0b8ea2ccd09ce051e4d378489e95cd09778f1809adcfd",
                "sha256:75b15a7568dcec83136f5ac80adff9e9c450f554995a3c43e7e1c4c766ad4c76",
                "sha256:7861e89052f91d670050692e87459840179629978e3189aa2b6fb8685eace98c",
                "sha256:84e72bda0d397263ffdb1982a2b764c3f479e1302aa59f92fb636f2215d1fee0",
                "sha256:8cc0278bef8ef70b487452ee8d15adf18412997018bf807370f128535fde80c0",
                "sha256:a4eff8ed50de51d88dd745bae24a74415915f128a250c01a22f12e6ff9e44be9",
                "sha256:ad3b9d4e127d5b5f6993788732e9a4a6aa7a5451106c35eab61d7f3a63974c3d",
                "sha256:c2a96175f0e0fe385a79b103073017cff046357eccde1849885a4d5871839965",
                "sha256:cab1f4e4e84c22968eb959a24708a2dd29c25cb10a696eabda21cea8d84ca146",
                "sha256:cd0d530c72d423176f6ea4a2d7b098252bb4547ed2c7e09686ff3283878dbd0a",
                "sha256:d209142c89fc83fc79674454ad5b861d5d62af6670d0694384502f7151b3ae8f",
                "sha256:f1d1112f5fe9f5f3e03d74adf16ac436d7988af048949e27f9e10d3ea79e2596"
            ],
            "index": "pypi",
            "version": "==0.26.0"
        }
    },
    "develop": {}
}

[bw-matthew]

I no longer have LLVM 6.0.x installed so I cannot install llvmlite==0.26.0. Furthermore the most recent version of fastparquet no longer depends on llvmlite at all. So I performed the following operations:

pipenv --python 3.8.0 install llvmlite==0.39.0 # 0.39.1 exists
pipenv install fastparquet==0.3.2 -v

This lead to the following graph

➜ pipenv graph
cramjam==2.5.0
fastparquet==0.3.2
  - numba [required: >=0.28, installed: 0.56.2]
    - importlib-metadata [required: Any, installed: 4.12.0]
      - zipp [required: >=0.5, installed: 3.8.1]
    - llvmlite [required: >=0.39.0dev0,<0.40, installed: 0.39.0]
    - numpy [required: >=1.18,<1.24, installed: 1.23.3]
    - setuptools [required: <60, installed: 59.8.0]
  - numpy [required: >=1.11, installed: 1.23.3]
  - pandas [required: >=0.19, installed: 1.4.4]
    - numpy [required: >=1.18.5, installed: 1.23.3]
    - python-dateutil [required: >=2.8.1, installed: 2.8.2]
      - six [required: >=1.5, installed: 1.16.0]
    - pytz [required: >=2020.1, installed: 2022.2.1]
  - six [required: Any, installed: 1.16.0]
  - thrift [required: >=0.11.0, installed: 0.16.0]
    - six [required: >=1.7.2, installed: 1.16.0]
fsspec==2022.8.2
packaging==21.3
  - pyparsing [required: >=2.0.2,!=3.0.5, installed: 3.0.9]

So it has not upgraded llvmlite even though a newer version exists. Furthermore, if I change this to install llvmlite 0.38.0 then it downgrades numba to 0.55.2. This happens both by altering the existing environment or creating a new one.

As a separate comment the last time I used pipenv it felt slow and unfortunately issues like this one happened to me several times. My first impression of the newest version is great. Thank you for all the hard work.

I believe that this issue is fixed, I’m not closing it because I cannot strictly confirm the original test case. If you / dqkqd want to close it then that is fine with me.

[rvanlaar]

After seeing the updates to the ticket I wanted to know if this was solved, especially since this issue made me move away from pipenv for all my projects.

It seems fixed. I’m now greeted with the following message:

[pipenv.exceptions.ResolutionFailure]: Warning: Your dependencies could not be resolved. You likely have a mismatch in your sub-dependencies.

This is the pipfile I used:

[[source]]
name = "pypi"
url = "https://pypi.org/simple"
verify_ssl = true

[dev-packages]
pylint = "==2.4.4"

[packages]
astroid = "==1.5.2"

[requires]
python_version = "3.10"