Potential dependency conflicts between molo-core and djangorestframework

[NeolithEra]

Hi, as shown in the following full dependency graph of molo-core, molo-core requires djangorestframework ==3.10.3, molo-core requires wagtail <2.7,>=2.6.2 (wagtail 2.6.3 will be installed, i.e., the newest version satisfying the version constraint), and directed dependency wagtail 2.6.3 transitively introduces djangorestframework >=3.7.4,<4.0.

Obviously, there are multiple version constraints set for djangorestframework in this project. However, according to pip's “first found wins” installation strategy, djangorestframework 3.10.3 (i.e., the newest version satisfying constraint ==3.10.3) is the actually installed version.

Although the first found package version djangorestframework 3.10.3 just satisfies the later dependency constraint （djangorestframework ==3.10.3), such installed version is very close to the upper bound of the version constraint of djangorestframework specified by wagtail 2.6.3.

Once wagtail upgrades，its newest version will be installed.Therefore, it will easily cause a dependency conflict (build failure), if the upgraded wagtail version introduces a higher version of djangorestframework , violating its another version constraint ==3.10.3.

According to the release history of wagtail, it habitually upgrates Djangorestframework in its recent releases. For instance, wagtail 1.8rc1 upgrated Djangorestframework ’s constraint from >=3.1.3 to >=3.1.3,<4.0, and wagtail 2.1rc1 upgrated Djangorestframework ’s constraint from >=3.1.3,<4.0 to >=3.7.4,<4.0.

As such, it is a warm warning of a potential dependency conflict issue for molo-core.

Dependency tree

molo-core   - 10.2.5
| +- babel(install version:2.8.0 version range:*)
| | +- pytz(install version:2019.3 version range:>=2015.7)
| +- beautifulsoup4(install version:4.6.0 version range:==4.6.0)
| +- boto(install version:2.49.0 version range:==2.49.0)
| +- cached-property(install version:1.5.1 version range:*)
| +- celery(install version:3.1.26.post2 version range:<4.0)
| +- cookiecutter(install version:1.0.0 version range:==1.0.0)
| +- dj-database-url(install version:0.5.0 version range:*)
| +- Django(install version: version range:<.3,>=2.2.5)
| +- django-cas-ng(install version:3.6.0 version range:<3.7,>=3.6.0)
| | +- django(install version:3.0.5 version range:>=1.11)
| | | +- asgiref (install version: version range:=3.2)
| | | +- pytz(install version:2019.3 version range:*)
| | | +- sqlparse (install version:0.3.1 version range:>=0.2.2)
| | +- python-cas(install version:1.5.0 version range:>=1.4.0)
| | | +- lxml(install version:4.5.0 version range:>=3.4)
| | | +- requests(install version:2.23.0 version range:>=2.11.1)
| | | | +- certifi(install version:2020.4.5.1 version range:>=2017.4.17)
| | | | +- chardet(install version:3.0.4 version range:>=3.0.2,<4)
| | | | +- idna(install version:2.9 version range:>=2.5,<3)
| | | | +- urllib3(install version:1.25.9 version range:>=1.21.1,<1.26)
| | | +- six(install version:1.14.0 version range:>=1.10.0)
| +- django-daterange-filter(install version:1.3.0 version range:*)
| | +- django(install version:3.0.5 version range:*)
| | | +- asgiref (install version: version range:=3.2)
| | | +- pytz(install version:2019.3 version range:*)
| | | +- sqlparse (install version:0.3.1 version range:>=0.2.2)
| +- django-el-pagination(install version:3.1.0 version range:==3.1.0)
| | +- django(install version:3.0.5 version range:>=1.8.0)
| | | +- asgiref (install version: version range:=3.2)
| | | +- pytz(install version:2019.3 version range:*)
| | | +- sqlparse (install version:0.3.1 version range:>=0.2.2)
| +- django-enumfield(install version:1.5 version range:==1.5)
| +- django-extensions(install version:1.9.9 version range:>=1,<2)
| | +- six(install version:1.14.0 version range:>=1.2)
| | +- typing(install version:3.7.4.1 version range:*)
| +- django-google-analytics-app(install version: version range:<.5,>=4.4.0)
| +- django-import-export(install version:2.0.2 version range:*)
| | +- diff-match-patch(install version:20181111 version range:*)
| | +- Django(install version:3.0.5 version range:>=2.0)
| | | +- asgiref (install version: version range:=3.2)
| | | +- pytz(install version:2019.3 version range:*)
| | | +- sqlparse (install version:0.3.1 version range:>=0.2.2)
| | +- tablib(install version:1.1.0 version range:>=0.14.0)
| +- django-libsass(install version:0.8 version range:*)
| | +- django-compressor(install version:2.4 version range:>=1.3)
| | | +- django-appconf(install version:1.0.4 version range:>=1.0.3)
| | | | +- django(install version:3.0.5 version range:*)
| | | +- rcssmin(install version:1.0.6 version range:==1.0.6)
| | | +- rjsmin(install version:1.1.0 version range:==1.1.0)
| | | +- six(install version:1.14.0 version range:>=1.12.0)
| | +- libsass(install version:0.20.0 version range:<1,>=0.7.0)
| +- django-mptt(install version:0.10.0 version range:<0.11,>=0.10.0)
| | +- django(install version:3.0.5 version range:>=1.11)
| | | +- asgiref (install version: version range:=3.2)
| | | +- pytz(install version:2019.3 version range:*)
| | | +- sqlparse (install version:0.3.1 version range:>=0.2.2)
| | +- django-js-asset(install version:1.2.2 version range:*)
| +- django-phonenumber-field(install version:1.3.0 version range:==1.3.0)
| | +- babel(install version:2.8.0 version range:*)
| | | +- pytz(install version:2019.3 version range:>=2015.7)
| | +- django(install version:3.0.5 version range:>=1.5)
| | | +- asgiref (install version: version range:=3.2)
| | | +- pytz(install version:2019.3 version range:*)
| | | +- sqlparse (install version:0.3.1 version range:>=0.2.2)
| +- django-prometheus(install version:2.1.0.dev14 version range:*)
| +- django-storages(install version:1.7.1 version range:==1.7.1)
| | +- django(install version:3.0.5 version range:>=1.11)
| | | +- asgiref (install version: version range:=3.2)
| | | +- pytz(install version:2019.3 version range:*)
| | | +- sqlparse (install version:0.3.1 version range:>=0.2.2)
| +- django-treebeard(install version:4.2.0 version range:==4.2.0)
| +- djangorestframework(install version:3.10.3 version range:==3.10.3)
| +- ImageHash(install version:3.4 version range:==3.4)
| +- markdown(install version:3.2.1 version range:>=3.0.1)
| | +- setuptools (install version:46.1.3 version range:>=36)
| +- mote-praekelt(install version:0.1.6 version range:<0.2,>=0.1.6)
| | +- beautifulsoup4(install version:4.6.0 version range:*)
| | +- dill(install version:0.3.1.1 version range:*)
| | +- django(install version:3.0.5 version range:*)
| | | +- asgiref (install version: version range:=3.2)
| | | +- pytz(install version:2019.3 version range:*)
| | | +- sqlparse (install version:0.3.1 version range:>=0.2.2)
| | +- djangorestframework(install version:3.10.3 version range:*)
| | +- djangorestframework-jwt(install version:1.11.0 version range:*)
| | | +- pyjwt(install version:1.7.1 version range:<2.0.0,>=1.5.2)
| | +- pypandoc(install version:1.5 version range:*)
| | | +- pip(install version:20.0.2 version range:>=8.1.0)
| | | +- setuptools(install version:46.1.3 version range:*)
| | | +- wheel(install version:0.34.2 version range:>=0.25.0)
| | +- pyyaml(install version:5.3.1 version range:*)
| | +- six(install version:1.14.0 version range:*)
| | +- xmltodict(install version:0.12.0 version range:*)
| | +- yamlordereddictloader(install version:0.4.0 version range:*)
| | | +- pyyaml(install version:5.3.1 version range:*)
| +- prometheus_client(install version: version range:*)
| +- raven(install version:6.10.0 version range:<6.11,>=6.10.0)
| +- redis(install version:3.4.1 version range:*)
| +- requests(install version:2.23.0 version range:*)
| | +- certifi(install version:2020.4.5.1 version range:>=2017.4.17)
| | +- chardet(install version:3.0.4 version range:>=3.0.2,<4)
| | +- idna(install version:2.9 version range:>=2.5,<3)
| | +- urllib3(install version:1.25.9 version range:>=1.21.1,<1.26)
| +- setuptools(install version:46.1.3 version range:>=18.5)
| +- six(install version:1.14.0 version range:>=1.12.0)
| +- ujson(install version:1.35 version range:==1.35)
| +- unicodecsv(install version:0.14.1 version range:==0.14.1)
| +- unicore.content(install version:1.0.4 version range:*)
| +- Unidecode(install version:0.04.16 version range:==0.04.16)
| +- wagtail(install version:2.6.3 version range:<2.7,>=2.6.2)
| | +- beautifulsoup4(install version:4.6.0 version range:>=4.5.1,<4.6.1)
| | +- django(install version:2.2.12 version range:>=2.0,<2.3)
| | | +- pytz(install version:2019.3 version range:*)
| | | +- sqlparse(install version:0.3.1 version range:*)
| | +- django-modelcluster(install version:4.4.1 version range:>=4.2,<5.0)
| | | +- pytz(install version:2019.3 version range:>=2015.2)
| | +- django-taggit(install version:0.24.0 version range:<1.0,>=0.23)
| | | +- django(install version:3.0.5 version range:>=1.11)
| | | | +- asgiref (install version: version range:=3.2)
| | | | +- pytz(install version:2019.3 version range:*)
| | | | +- sqlparse (install version:0.3.1 version range:>=0.2.2)
| | +- django-treebeard(install version:4.2.0 version range:>=4.2.0,<5.0)
| | +- djangorestframework(install version:3.10.3 version range:>=3.7.4,<4.0)
| | +- draftjs-exporter(install version:2.1.7 version range:<3.0,>=2.1.5)
| | +- html5lib(install version:1.0.1 version range:>=0.999,<2)
| | | +- six(install version:1.14.0 version range:>=1.9)
| | | +- webencodings(install version:0.5.1 version range:*)
| | +- pillow(install version:6.2.2 version range:<7.0.0,>=4.0.0)
| | | +- black(install version:19.10b0 version range:*)
| | | | +- appdirs(install version:1.4.3 version range:*)
| | | | +- attrs(install version:19.3.0 version range:>=18.1.0)
| | | | +- click(install version:7.1.1 version range:>=6.5)
| | | | +- pathspec(install version:0.8.0 version range:>=0.6,<1)
| | | | +- regex(install version:2020.4.4 version range:*)
| | | | +- toml(install version:0.10.0 version range:>=0.9.4)
| | | | +- typed-ast(install version:1.4.1 version range:>=1.4.0)
| | | +- check-manifest(install version:0.41 version range:*)
| | | | +- pep517(install version:0.8.2 version range:*)
| | | | +- toml(install version:0.10.0 version range:*)
| | | +- coverage(install version:5.1 version range:*)
| | | +- coveralls(install version:2.0.0 version range:*)
| | | | +- coverage(install version:5.1 version range:>=4.1,<6.0)
| | | | +- docopt(install version:0.6.2 version range:>=0.6.1)
| | | | +- requests(install version:2.23.0 version range:>=1.0.0)
| | | +- jarn.viewdoc(install version:2.3 version range:*)
| | | +- olefile(install version:0.46 version range:*)
| | | +- pycodestyle(install version:2.5.0 version range:*)
| | | +- pyflakes(install version:2.2.0 version range:*)
| | | +- pyroma(install version:2.6 version range:*)
| | | | +- docutils(install version:0.16 version range:*)
| | | | +- pygments(install version:2.6.1 version range:*)
| | | | +- setuptools(install version:46.1.3 version range:*)
| | | +- pytest(install version:5.4.1 version range:*)
| | | | +- atomicwrites(install version:1.3.0 version range:>=1.0)
| | | | +- attrs(install version:19.3.0 version range:>=17.4.0)
| | | | +- colorama(install version:0.4.3 version range:*)
| | | | +- importlib-metadata(install version:1.6.0 version range:>=0.12)
| | | | +- more-itertools(install version:8.2.0 version range:>=4.0.0)
| | | | +- packaging(install version:20.3 version range:*)
| | | | +- pathlib2(install version:2.3.5 version range:>=2.2.0)
| | | | +- pluggy(install version:0.13.1 version range:>=0.12,<1.0)
| | | | +- py(install version:1.8.1 version range:>=1.5.0)
| | | | +- wcwidth(install version:0.1.9 version range:*)
| | | +- pytest-cov(install version:2.8.1 version range:*)
| | | | +- coverage(install version:5.1 version range:>=4.4)
| | | | +- pytest(install version:5.4.1 version range:>=3.6)
| | | +- sphinx-rtd-theme(install version:0.4.3 version range:*)
| | | | +- sphinx(install version:3.0.1 version range:*)
| | +- pytz(install version:2019.3 version range:>=2016.6)
| | +- requests(install version:2.23.0 version range:>=2.11.1,<3.0)
| | | +- certifi(install version:2020.4.5.1 version range:>=2017.4.17)
| | | +- chardet(install version:3.0.4 version range:>=3.0.2,<4)
| | | +- idna(install version:2.9 version range:>=2.5,<3)
| | | +- urllib3(install version:1.25.9 version range:>=1.21.1,<1.26)
| | +- six(install version:1.14.0 version range:>=1.11,<2.0)
| | +- unidecode(install version:1.1.1 version range:>=0.04.14,<2.0)
| | +- willow(install version:1.1 version range:<1.2,>=1.1)
| +- wagtailmedia(install version:0.3.1 version range:<0.4,>=0.3.1)
| | +- wagtail(install version:2.6.3 version range:>=2.2)
| | | +- beautifulsoup4(install version:4.6.0 version range:>=4.5.1,<4.6.1)
| | | +- django(install version:2.2.12 version range:>=2.0,<2.3)
| | | | +- pytz(install version:2019.3 version range:*)
| | | | +- sqlparse(install version:0.3.1 version range:*)
| | | +- django-modelcluster(install version:4.4.1 version range:>=4.2,<5.0)
| | | | +- pytz(install version:2019.3 version range:>=2015.2)
| | | +- django-taggit(install version:0.24.0 version range:<1.0,>=0.23)
| | | | +- django(install version:3.0.5 version range:>=1.11)
| | | +- django-treebeard(install version:4.2.0 version range:>=4.2.0,<5.0)
| | | +- djangorestframework(install version:3.10.3 version range:>=3.7.4,<4.0)
| | | +- draftjs-exporter(install version:2.1.7 version range:<3.0,>=2.1.5)
| | | +- html5lib(install version:1.0.1 version range:>=0.999,<2)
| | | | +- six(install version:1.14.0 version range:>=1.9)
| | | | +- webencodings(install version:0.5.1 version range:*)
| | | +- pillow(install version:6.2.2 version range:<7.0.0,>=4.0.0)
| | | | +- black(install version:19.10b0 version range:*)
| | | | +- check-manifest(install version:0.41 version range:*)
| | | | +- coverage(install version:5.1 version range:*)
| | | | +- coveralls(install version:2.0.0 version range:*)
| | | | +- jarn.viewdoc(install version:2.3 version range:*)
| | | | +- olefile(install version:0.46 version range:*)
| | | | +- pycodestyle(install version:2.5.0 version range:*)
| | | | +- pyflakes(install version:2.2.0 version range:*)
| | | | +- pyroma(install version:2.6 version range:*)
| | | | +- pytest(install version:5.4.1 version range:*)
| | | | +- pytest-cov(install version:2.8.1 version range:*)
| | | | +- sphinx-rtd-theme(install version:0.4.3 version range:*)
| | | +- pytz(install version:2019.3 version range:>=2016.6)
| | | +- requests(install version:2.23.0 version range:>=2.11.1,<3.0)
| | | | +- certifi(install version:2020.4.5.1 version range:>=2017.4.17)
| | | | +- chardet(install version:3.0.4 version range:>=3.0.2,<4)
| | | | +- idna(install version:2.9 version range:>=2.5,<3)
| | | | +- urllib3(install version:1.25.9 version range:>=1.21.1,<1.26)
| | | +- six(install version:1.14.0 version range:>=1.11,<2.0)
| | | +- unidecode(install version:1.1.1 version range:>=0.04.14,<2.0)
| | | +- willow(install version:1.1 version range:<1.2,>=1.1)

Thanks for your help. Best, Neolith

[NeolithEra]

Suggested Solution

1. Loosen the version range of djangorestframework to be >=3.10.3.
2. Remove your direct dependency djangorestframework , and use the djangorestframework transitively introduced by wagtail.
3. Change your direct dependency wagtail to be <=2.6.3,>=2.6.2. @codiebeulaine Which solution do you prefer, 1 ,2or 3? Please let me know your choice. May I pull a request to solve this issue?

[NeolithEra]

@moh-moola,Could you help me review this issue? Thx :p