-
-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
pipenv refuses to update a dependency in Pipfile.lock if it is not mentioned in Pipfile #3014
Comments
This is not really viable with how I’m closing this since there is not a way forward at the current time. Feel free to suggest this in the future if/when we switch to the new mechanism (you’ll know when that happens). |
@uranusjr Thanks for the explanation, I understand this is not how update is supposed to work. However, this is currently how the Example Pipenv Upgrade Workflow implicitly suggests it works:
Would a PR adding a note be welcome? Something along the lines of
|
@JeanFred Yes, please! |
- Upgrade pythonfinder - Upgrade vistir - Upgrade requirementslib - Vendor backported version of `functools.lru_cache` for performance - Fix editable dependency installation when markers are present - Fix extraneous resource warnings - Fix filesystem output stream encoding issues - Fix pythonfinder non-standard python name issues - Provide full interaction layer to `Pipfile` and `Pipfile.lock` in requirementslib - Fixes #3017 - Fixes #3014 - Fixes #3021 - Fixes #3019 Signed-off-by: Dan Ryan <[email protected]>
- Upgrade pythonfinder - Upgrade vistir - Upgrade requirementslib - Vendor backported version of `functools.lru_cache` for performance - Fix editable dependency installation when markers are present - Fix extraneous resource warnings - Fix filesystem output stream encoding issues - Fix pythonfinder non-standard python name issues - Provide full interaction layer to `Pipfile` and `Pipfile.lock` in requirementslib - Fixes #3017 - Fixes #3014 - Fixes #3021 - Fixes #3019 Signed-off-by: Dan Ryan <[email protected]> Update vendored dependencies - Update shellingham, tomlkit, requests, urllib3, certifi, vistir and parse - Fixes #2820 - Fixes #2852 Signed-off-by: Dan Ryan <[email protected]> Cleanup old vendored dependencies Signed-off-by: Dan Ryan <[email protected]>
https://nvd.nist.gov/vuln/detail/CVE-2019-11324 Not possible to update just one transitive dependency: pypa/pipenv#3014
Be sure to check the existing issues (both open and closed!), and make sure you are running the latest version of Pipenv.
Check the diagnose documentation for common issues before posting! We may close your issue if it is very similar to one of them. Please be considerate, or be on your way.
Make sure to mention your debugging experience if the documented solution failed.
Issue description
While trying to come up with a PR to fix the problem with customized Python versions raising errors I've found a problem with pythonfinder's Pipfile.lock: it mentioned vistir==0.1.1 whereas it was using features from vistir==0.1.7:
Then I tried to update only vistir version to ensure pipenv doesn't touch anything else unless it has to and I did this:
But as you can see, pipenv refuses to lock a fresher version, because it turns out that
vistir
is fetched as a dependency ofpythonfinder
itself, which is mentioned in the Pipfile.Expected result
In this particular case, I'll probably just add
vistir
to the list of default packages, but I think it should be possible for Pipenv to update a thirdparty dependency without mentioning it in Pipfile explicitly.Actual result
pipenv complains that
vistir
is not in Pipfile and exits.Steps to replicate
$ pipenv --support
Pipenv version:
'2018.10.10.dev0'
Pipenv location:
'/home/immerrr/src/pipenv/pipenv'
Python location:
'/usr/bin/python'
Python installations found:
3.6.4
:/home/immerrr/src/pyenv/versions/3.6.4/bin/python3.6m
3.5.2
:/usr/bin/python3.5
3.5.2
:/usr/bin/python3.5m
3.6.4
:/home/immerrr/src/pyenv/versions/3.6.4/bin/python3.6
2.7.12
:/usr/bin/python2.7
3.6.6
:/mnt/extraspace/virtualenvs/pythonfinder-o0EK7psS/bin/python3.6m
3.6.6
:/home/immerrr/src/pyenv/versions/3.6.6/bin/python3.6m
3.7.0
:/home/immerrr/src/pyenv/versions/3.7.0/bin/python3.7m
3.6.6
:/home/immerrr/src/pyenv/versions/3.6.6/bin/python3.6
3.7.0
:/home/immerrr/src/pyenv/versions/3.7.0/bin/python3.7
PEP 508 Information:
System environment variables:
HISTTIMEFORMAT
UPSTART_EVENTS
PYTHONDONTWRITEBYTECODE
XDG_SESSION_TYPE
LC_PAPER
VIRTUAL_ENV
SHELL
XDG_DATA_DIRS
MANDATORY_PATH
TERMINATOR_UUID
QT_ACCESSIBILITY
UNITY_DEFAULT_PROFILE
HISTSIZE
UPSTART_INSTANCE
JOB
SESSION
CLUTTER_IM_MODULE
XMODIFIERS
JAVA_HOME
GTK2_MODULES
WORKON_HOME
XDG_RUNTIME_DIR
COMPIZ_BIN_PATH
J2SDKDIR
XDG_SESSION_ID
DBUS_SESSION_BUS_ADDRESS
DEFAULTS_PATH
DESKTOP_SESSION
GTK_MODULES
INSTANCE
XDG_MENU_PREFIX
LS_COLORS
IRIVERCP
GNOME_DESKTOP_SESSION_ID
LESSOPEN
USER
XDG_VTNR
PS1
XAUTHORITY
LANGUAGE
LC_MEASUREMENT
QT_QPA_PLATFORMTHEME
COMPIZ_CONFIG_PROFILE
EDITOR
GPG_AGENT_INFO
LANG
GDMSESSION
UPSTART_JOB
TERMINATOR_DBUS_NAME
XDG_SEAT_PATH
PIP_PYTHON_PATH
_
GTK_IM_MODULE
XDG_CONFIG_DIRS
PYENV_ROOT
PIP_SHIMS_BASE_MODULE
LC_TIME
HISTFILE
XDG_GREETER_DATA_DIR
QT4_IM_MODULE
HOME
DISPLAY
XDG_SESSION_DESKTOP
QT_LINUX_ACCESSIBILITY_ALWAYS_ON
PIPENV_ACTIVE
AIRFLOW_HOME
VTE_VERSION
TERMINATOR_DBUS_PATH
XDG_CURRENT_DESKTOP
LESSCLOSE
GNOME_KEYRING_PID
J2REDIR
UNITY_HAS_3D_SUPPORT
QT_IM_MODULE
LOGNAME
XDG_SEAT
GNOME_KEYRING_CONTROL
PATH
TERM
XDG_SESSION_PATH
SESSIONTYPE
IM_CONFIG_PHASE
GIO_LAUNCHED_DESKTOP_FILE_PID
HISTFILESIZE
GIO_LAUNCHED_DESKTOP_FILE
COLORTERM
SSH_AUTH_SOCK
TZ
DERBY_HOME
UPSTART_SESSION
GPGKEY
GDM_LANG
HISTCONTROL
SHLVL
PWD
Pipenv–specific environment variables:
PIPENV_ACTIVE
:1
Debug–specific environment variables:
PATH
:/mnt/extraspace/virtualenvs/pythonfinder-o0EK7psS/bin:/home/immerrr/.gem/ruby/2.3.0/bin:/home/immerrr/.cask/bin:/home/immerrr/platform-tools:/home/immerrr/bin:/home/immerrr/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/usr/lib/jvm/java-8-oracle/bin:/usr/lib/jvm/java-8-oracle/db/bin:/usr/lib/jvm/java-8-oracle/jre/bin:/home/immerrr/.rvm/bin:/home/immerrr/src/pyenv/bin
SHELL
:/bin/bash
EDITOR
:emacs -nw -q -l ~/.emacs.d/lisp/mmr-minimal.el
LANG
:en_US.UTF-8
PWD
:/home/immerrr/src/pythonfinder
VIRTUAL_ENV
:/mnt/extraspace/virtualenvs/pythonfinder-o0EK7psS
Contents of
Pipfile
('/home/immerrr/src/pythonfinder/Pipfile'):Contents of
Pipfile.lock
('/home/immerrr/src/pythonfinder/Pipfile.lock'):The text was updated successfully, but these errors were encountered: