Repository navigation
Declaring extras in constraints file installs also extra dependencies even if not instructed to #6628
Description
Activity
@pfmoore @pradyunsg @uranusjr Do we need to resolve this before the 20.2b2, or do we just need to put a "known bug" item about it in the "migrating to the new resolver" guide?
I believe this already does not work in the new resolver (it rejects the constraints file immediately). This is worth a mention in the guide, along with other changes we made to constraints, but it shouldn’t be categorised as a bug, but a behavioural difference IMO. This issue is describing a “bug” in the old resolver that the new one does not have, but some may consider this is a feature the new resolver doesn’t (and won’t) implement
@uranusjr Is correct. This is a completely intentional change in constraints for the new resolver. I do think it needs clearly calling out in the release notes, though, as it's definitely a behaviour change and we'd need to get feedback on how it impacts people.
@pradyunsg @pfmoore @uranusjr ok to close this or rename it?
OK to close, given that we don't allow this form with the new resolver.
Reacted by Paul Moore- locked as resolved and limited conversation to collaborators
on Oct 12, 2021
Environment
19.1.13.7.2KDE NeonDescription
In constraints file, when declaring a package with extras, all the dependencies of it get installed, even if actual requirement does not declare extras.
How to Reproduce
Output
This installs not only direct
requestsdependencies:But also
[security]extras:Expected behavior
pip should install only direct dependencies, even if extras are declared in constraints file.
This is such a simple case and easy to reproduce, it must be expected behavior. But why? And where is it documented?