Q: Is it planned to merge this into pip? (A: not for the time being)

[Tset-Noitamotua]

Hey, I like the idea but don't like to install another package. Instead I would like to see this functionality in native pip. Do you plan to make a pull request?

It would be cool if pip list output would look like:

Package                    Version     Update
                           installed   available
-------------------------- --------    --------
pip                        9.0.1       10.0.0
pyrfc                      1.9.5
requests                   2.12.4
robotframework             3.0.1
robotframework-requests    0.4.6
robotframework-sap-library 0.0.1       1.0.0
setuptools                 32.3.1
wheel                      0.30.0a0

[jgonggrijp]

What you describe is pip list --outdated --format=columns. Incidentally, pip-review will be a wrapper around pip list --outdated when #32 is resolved. @bil-elmoussaoui is currently working on that in #41. However, you will still need to install pip-review as a separate package after that if you want to have the --auto or --interactive functionality.

pip-review was not originally forked from pip, so merging the functionality into pip takes more than just a pull request. Currently, I'm not planning to spend any effort on that. However, I'll open a poll; if this turns out to be a popular request, I may change my mind. (Voters: please attach an emoticon to the opening post.)

If you do not want to depend on my whims, you have two options. The first option is to submit a feature request to the pip maintainers and hope that they feel like merging pip-review into pip. The second option is to do the necessary work by yourself and submit a pull request to pip. Make sure to read their contribution guidelines in that case.

If you end up submitting a feature or pull request to the pip repository, please put a reference here so I can follow the progress. Thanks in advance.

[ghost]

I'm somewhat familiar with the situation. pip-review cannot be merged into pip

because pip does not have a dependency solver,
because implementing a dependency solver in pip is currently impossible,
because the pip maintainers will not accept any solutions until some PEP is completed, and it's not
because the PEP they want completed is currently "on hold"
because they want another PEP to be completed first, which is also "on hold"
(at this point I just gave up on figuring out the traceback)

Now, it would actually be possible to implement a dependency solver into pip-review because enthought has already developed the algorithm. But the questions are

1. Would @jgonggrijp be okay with that?
2. Would @jgonggrijp, @xoviat, or someone else have time to do this?
3. Is this even possible? Well...no. Because it turns out that @nlhkabu tried to allow requirements to be downloaded from pypi, but failed because...wait for it...they want another PEP to be completed first.

So no, I wouldn't bet on integrating this into pip. Or pip resolving these issues anytime soon. The reason that I use this project is that I have given up on pip.

[jgonggrijp]

Thanks for sharing your knowledge on this, @xoviat.

I am a bit confused. What does dependency tracking have to do with integrating pip-review into pip?

Answering your questions:

(1) Right now, I am somewhat inclined to say "no", but please continue discussing your ideas. Once I better understand the relation between merging into pip and dependency tracking, you might be able to convince me. My current inclination to "no" is based on the following observations:

• With Reimplement pip-review on top of pip list --outdated #32 and use pip list by default #41, pip-review is currently moving in a direction where it defines less of its own logic and relies more on pip list. Adding dependency tracking to pip-review would be a move in the opposite direction.
• As of version 9, pip list has --process-dependency-links and --not-required flags. I never tried these options and I do not know when these options first appeared, but the existence of these options does suggest that pip actually implements some form of dependency tracking.
• pip-compile (from the current pip-tools package) does include a dependency tracker. So depending on the exact use case, pip-review might not need to offer dependency tracking because pip-compile already does it.

Note that the last point is more or less neutral. If we do decide to add dependency tracking, we could take advantage of the existing implementation in pip-compile.

(2) I may find some time if I am convinced that something needs to be done.

You already answered (3) so I won't go into that. ;-)

[ghost]

I am a bit confused. What does dependency tracking have to do with integrating pip-review into pip?

pip will not accept any feature which upgrades packages automatically until pip has a dependency solver.

Note that the last point is more or less neutral. If we do decide to add dependency tracking, we could take advantage of the existing implementation in pip-compile.

I glanced at that implementation and it looks like it downloads packages to discover the requirements. That is really a less than ideal implementation because you may need to backtrack. enthought/sat-solver is a better implementation, but it's currently unworkable because as I said, you need to download the package to discover requirements.

[ghost]

In case you're wondering the PEP that appears to be blocking everything is PEP 426. Apparently no progress can be made until it's completed, but the current status is "deferred." Possibly it has become bogged down in bureaucracy.

[jgonggrijp]

So what about the --process-dependency-links option of pip list? Is that something else?

[ghost]

That has nothing to do with solving dependencies, and it's also being removed in pypa/pip#3939.

[ghost]

By the way, when I say dependency solver, I mean an algorithm that can address this:

The dependency issue arises around shared packages or libraries on which several other packages have dependencies but where they depend on different and incompatible versions of the shared packages. If the shared package or library can only be installed in a single version, the user may need to address the problem by obtaining newer or older versions of the dependent packages. This, in turn, may break other dependencies and push the problem to another set of packages.

Essentially you need to consider all installed packages along with the packages to be installed and then find a set of distributions that complies with all package requirements; not a trivial thing. In addition, you need to uninstall packages that have their dependencies uninstalled.

[jgonggrijp]

Thank you for the explanation! Closing then.

[ghost]

This issue is closed, but I originally couldn't find the discussion that I was remembering involving @nlhkabu. For historical purposes, it is in pypi/warehouse#789.