Extras in dev dependencies are not locked

When I add a regular dependency, but also add it with additional extras in --dev, the extra required packages are not recorded in Pipfile.lock.

For example, requests[secutity] requires cryptography, but (for some reason) I only want the security extra for development:

$ pipenv install requests
...
$ pipenv install --dev 'requests[security]'
...
$ grep cryptography Pipfile.lock
# (no output)
$ pipenv run python -c 'import cryptography as c; print(c)'
<module 'cryptography' from '...'>
$ pipenv clean
Uninstalling 'asn1crypto'…
Uninstalling 'cffi'…
Uninstalling 'cryptography'…
Uninstalling 'pycparser'…
Uninstalling 'pyopenssl'…
Uninstalling 'six'…
$ pipenv install --dev
...
$ pipenv run python -c 'import cryptography as c; print(c)'
Traceback (most recent call last):
  File "<string>", line 1, in <module>
ModuleNotFoundError: No module named 'cryptography'

---

Expected result

The cryptography package’s hash should be recorded in Pipfile.lock, and if it gets uninstalled, pipenv install --dev should re-install it.

Actual result

The extra’s requirements are not in Pipfile.lock; pipenv install --dev doesn’t re-install them.

Steps to replicate

See above.

---

Resulting Pipfile

[[source]]
url = "https://pypi.org/simple"
verify_ssl = true
name = "pypi"

[packages]
requests = "*"

[dev-packages]
requests = {extras = ["security"]}

[requires]
python_version = "3.6"

[bbc2]

I would like to add that this issue is more subtle, and more likely to occur, than what I’ve read so far.

For instance, with the following Pipfile:

[[source]]
name = "pypi"
url = "https://pypi.org/simple"
verify_ssl = true

[dev-packages]
fakeredis = "*"

[packages]
rq = "*"

[requires]
python_version = "3.7"

You end up with the wrong version of the redis package:

fakeredis==1.0.2
  - redis [required: <3.2, installed: 3.2.0]
  - six [required: >=1.12, installed: 1.12.0]
  - sortedcontainers [required: Any, installed: 2.1.0]
rq==0.13.0
  - click [required: >=5.0, installed: 7.0]
  - redis [required: >=3.0.0, installed: 3.2.0]

As you can see, this is not just a matter of specifying the same dependency twice in your Pipfile. Maybe this should be a separate issue?

[techalchemy]

As a brief update on this point – you could consider trying out https://github.com/sarugaku/passa which will lock (but only in an activated virtualenv) and write to the lockfile in a pipenv compatible format. It should handle conflicts gracefully and merge dependency sections as well.