Old dependency from install_requires not removed from env after removal from manifest

After removing a dependency from install_requires in my setup.py, and running pipenv update, the removed dependency is still present in the environment.

---

Please run $ python -m pipenv.help, and paste the results here.

Pipenv version: '11.8.0'

Pipenv location: '/usr/local/Cellar/pipenv/11.8.0/libexec/lib/python3.6/site-packages/pipenv'

Python location: '/usr/local/Cellar/pipenv/11.8.0/libexec/bin/python'

Other Python installations in PATH:

• 2.7: /usr/local/bin/python2.7

• 2.7: /usr/local/bin/python2.7

• 2.7: /usr/bin/python2.7

• 3.6: /usr/local/bin/python3.6m

• 3.6: /usr/local/bin/python3.6

• 2.7.14: /usr/local/bin/python

• 2.7.10: /usr/bin/python

• 2.7.14: /usr/local/bin/python2

• 3.6.4: /usr/local/bin/python3

PEP 508 Information:

{'implementation_name': 'cpython',
 'implementation_version': '3.6.4',
 'os_name': 'posix',
 'platform_machine': 'x86_64',
 'platform_python_implementation': 'CPython',
 'platform_release': '17.4.0',
 'platform_system': 'Darwin',
 'platform_version': 'Darwin Kernel Version 17.4.0: Sun Dec 17 09:19:54 PST '
                     '2017; root:xnu-4570.41.2~1/RELEASE_X86_64',
 'python_full_version': '3.6.4',
 'python_version': '3.6',
 'sys_platform': 'darwin'}

---

Expected result

I would expect that the dependency is removed from the environment, as nothing depends on it anymore.

Actual result

See detailed steps to replicate below:

Steps to replicate

Create the following simple setup.py

from setuptools import setup

setup(
    name='pipenvtest',
    version='0.1.0',
    description='testing',
    license='MIT',
    install_requires=[
        'plain_obj ~= 0.1.2',
    ]
)

Create a new pipenv by installing the current directory as editable pipenv install -e .

Check the dependency graph for the env, all looks good:

> pipenv graph
pipenvtest==0.1.0
  - plain-obj [required: ~=0.1.2, installed: 0.1.2]

Update setup.py to comment out the one dependency - this simulates removing a dependency

    install_requires=[
        # 'plain_obj ~= 0.1.2',
    ]

Run pipenv update to update the lockfile and environment

> pipenv update
Running $ pipenv lock then $ pipenv sync.
Locking [dev-packages] dependencies…
Locking [packages] dependencies…
Updated Pipfile.lock (86895b)!
Installing dependencies from Pipfile.lock (86895b)…
  🐍   ▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉▉ 1/1 — 00:00:00
To activate this project's virtualenv, run the following:
 $ pipenv shell
All dependencies are now up-to-date!

Run pipenv graph to view the environment

> pipenv graph
pipenvtest==0.1.0
plain-obj==0.1.2

plain-obj is still there - although it is no longer present in the lockfile.

[glenjamin]

Ok, that mostly makes sense.

The word sync implies to me that it would synchronise my environment against my lockfile - although to be fair the help text "Installs all packages specified in Pipfile.lock." doesn’t say this. The current semantics appear to be more of an ensure. (I’m not suggesting it be renamed).

You say that nothing pipenv does is secretly destructive - but does that mean sync will also refuse to downgrade a dependency that was previously installed if the lockfile has changed?

It would be useful to future users if the documentation contained an overview of the commands and the scenarios they’re expected to be used.

The same behaviour is seen if a dependency is removed from the Pipfile and lock + sync are run. I think it is non-obvious that the environment isn’t fully synchronised until also running the clean command.

[glenjamin]

I’ve just spotted the pipenv clean command - not sure how I overlooked this before.

Is there anywhere I can read up on why clean is a distinct separate step rather than part of sync?