Open jprestel-rue opened 1 month ago
I think, we have a similar case here. I have created a repository that showcases this: https://github.com/Crosswind/dependabot-pip-bug-showcase Our dependency node2vec requires numpy<2.0.0 and yet we receive a PR from dependabot stating that we should upgrade to numpy>2. I have set up an action which tries to do a simple pip install which fails. The PR with the failed pipeline run that's triggered on PR creation: https://github.com/Crosswind/dependabot-pip-bug-showcase/pull/1
@jprestel-rue Do you think this is the same issue or should I rather open a separate one? I am not familiar with pip-compile. We only use basic pip.
@jprestel-rue Do you think this is the same issue or should I rather open a separate one? I am not familiar with pip-compile. We only use basic pip.
I couldn't say if it's the same issue exactly, but, at the very least, it's the same sort of symptom.
Thank you! I'll leave it here for now and in case someone at GitHub decides to want this tracked separately, I'll happily create an issue for it.
Is there an existing issue for this?
Package ecosystem
pip
Package manager version
pip-tools 7.4.1; pip 24.2
Language version
python 3.12
Manifest location and content before the Dependabot update
/requirements.txt
/pyproject.toml
dependabot.yml content
Updated dependency
Unexpected upgrades
dependabot made these additional upgrades, which were not included by the native package manager
cattrs
23.2.3 -> 24.1.2typeguard
2.13.3 -> 4.3.0Missing dependency
dependabot failed to add the following transitive dependency, which the native package manager added:
aws-cdk-cloud-assembly-schema==36.3.0
aws-cdk-lib
What you expected to see, versus what you actually saw
Dependabot created dependency conflict by including an upgrade to
cattrs
andtypeguard
libraries:When running
pip-sync requirements.txt
I get the following error:Full output of
pip-sync requirements.txt
Diff of dependabot vs native package manager
Native package manager behavior
Upgrade procedure
Resulting
/requirements.txt
Diff versus previous:
Images of the diff or a link to the PR, issue, or logs
Diff created by dependabot
Full resulting
/requirements.txt
from dependabotSmallest manifest that reproduces the issue
pyproject.toml
And initial
/requirements.txt