Wrong version resolved

Observed:

Pipenv lock file contains incompatible versions (possibly related to #1220?). Specifically I have fixed the version of six==1.10 under packages and left the version of behave free under dev-packages. Behave 1.2.6 is locked even though that version depends on six==1.11. The pipenv install -d also completes without errors installing the two incompatible versions.

Using pipenv version: 11.8.3

Expected:

Pipenv picks an older version of behave or at least issues an error if there is nothing it can do.

Pipfile:

[[source]]
url = "https://pypi.python.org/simple"
name = "pypi"
verify_ssl = true

[packages]
six = "==1.10.0"

[dev-packages]
behave = "*"

pipenv graph

behave==1.2.6
  - parse [required: >=1.8.2, installed: 1.8.2]
  - parse-type [required: >=0.4.2, installed: 0.4.2]
    - parse [required: >=1.8, installed: 1.8.2]
    - six [required: >=1.11, installed: 1.10.0]
  - six [required: >=1.11, installed: 1.10.0]

Pipfile.lock:

{
    "_meta": {
        "hash": {
            "sha256": "11a70e32a7eb08dbb8cba49632a6f031bd484d516d4f3035554e71e5c6185f86"
        },
        "pipfile-spec": 6,
        "requires": {},
        "sources": [
            {
                "name": "pypi",
                "url": "https://pypi.python.org/simple",
                "verify_ssl": true
            }
        ]
    },
    "default": {
        "six": {
            "hashes": [
                "sha256:0ff78c403d9bccf5a425a6d31a12aa6b47f1c21ca4dc2573a7e2f32a97335eb1",
                "sha256:105f8d68616f8248e24bf0e9372ef04d3cc10104f1980f54d57b2ce73a5ad56a"
            ],
            "index": "pypi",
            "version": "==1.10.0"
        }
    },
    "develop": {
        "behave": {
            "hashes": [
                "sha256:b9662327aa53294c1351b0a9c369093ccec1d21026f050c3bd9b3e5cccf81a86",
                "sha256:ebda1a6c9e5bfe95c5f9f0a2794e01c7098b3dde86c10a95d8621c5907ff6f1c"
            ],
            "index": "pypi",
            "version": "==1.2.6"
        },
        "parse": {
            "hashes": [
                "sha256:8048dde3f5ca07ad7ac7350460952d83b63eaacecdac1b37f45fd74870d849d2"
            ],
            "version": "==1.8.2"
        },
        "parse-type": {
            "hashes": [
                "sha256:6e906a66f340252e4c324914a60d417d33a4bea01292ea9bbf68b4fc123be8c9",
                "sha256:f596bdc75d3dd93036fbfe3d04127da9f6df0c26c36e01e76da85adef4336b3c"
            ],
            "version": "==0.4.2"
        },
        "six": {
            "hashes": [
                "sha256:0ff78c403d9bccf5a425a6d31a12aa6b47f1c21ca4dc2573a7e2f32a97335eb1",
                "sha256:105f8d68616f8248e24bf0e9372ef04d3cc10104f1980f54d57b2ce73a5ad56a"
            ],
            "index": "pypi",
            "version": "==1.10.0"
        }
    }
}

[techalchemy]

@gusgordon we actually have your issue fixed in master in that it at least throws a resolution error, the original issue here is related to cross-graph dependency flattening (six==1.10, but we aren’t properly flattening the dependencies first)

[techalchemy]

@caspervdw just put the version you actually want as a pin (e.g pkg = “==x.y”) in your packages section for any conflict