10000 [BUG] ptb hardpins dependencies, causing problems for sub-dependencies · Issue #2758 · python-telegram-bot/python-telegram-bot · GitHub
[go: up one dir, main page]
Skip to content

[BUG] ptb hardpins dependencies, causing problems for sub-dependencies #2758

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
xmatthias opened this issue Oct 30, 2021 · 4 comments
Closed

[BUG] ptb hardpins dependencies, causing problems for sub-dependencies #2758

xmatthias opened this issue Oct 30, 2021 · 4 comments
Milestone
v20.0a0

Comments

@xmatthias
Copy link
xmatthias commented Oct 30, 2021 •
edited
Loading

Steps to Reproduce

Create a project with ptb and cachetools (for example) in requirements

requirements.txt

python-telegram-bot==13.7
cachetools==4.2.4

install that project

pip install -r requirements.txt

Collecting cachetools==4.2.4
  Downloading cachetools-4.2.4-py3-none-any.whl (10 kB)
ERROR: Cannot install cachetools==4.2.4 and python-telegram-bot==13.7 because these package versions have conflicting dependencies.

The proposed workaround from #2757 (comment) does NOT work with uptodate pip versions, and fails with the following approach.

pip install cachetools==4.2.4 -U
Collecting cachetools==4.2.4
  Using cached cachetools-4.2.4-py3-none-any.whl (10 kB)
Installing collected packages: cachetools
  Attempting uninstall: cachetools
    Found existing installation: cachetools 4.2.2
    Uninstalling cachetools-4.2.2:
      Successfully uninstalled cachetools-4.2.2
ERROR: pip's dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts.
python-telegram-bot 13.7 requires cachetools==4.2.2, but you have cachetools 4.2.4 which is incompatible.

Expected behaviour

Installation would not fail.

A library should not hard-pin install-dependencies (in setup.py) but instead use range-pinning.

Hard-pinned dependencies should only be used in requirements.txt - but not in setup.py - preventing other projects from updating.
to avoid unexpected failures, it's best-practice to range-pin dependencies, preventing major updates without proper testing, which ptb fails to do.

Actual behaviour

Installation fails

Operating System

not relevant
uptodate pip version

other

I've attempted a fix in #2757 - but one of the maintainers decided to rather try and discuss the issue away than fixing this, therefore i'm now asking this as issue, and i consider this a breaking bug (it breaks updates of dependent modules).

I'd expect a fix for this for both 13.x (minor version update) and 14.0 versions - as this can have security implications (you're preventing updating to a more uptodate version).
@tdudz
Copy link
tdudz commented Mar 30, 2022

any update here? having the same issue w.r.t. apscheduler pinning. broke my entire prod environment on arm64 machines since there is no compatible apscheduler arm64 build that matches ptb's pinned version

@Bibo-Joshi
Copy link
Member

Hi. This issue is on the todo-list for v14. v14 is under development. We don't have an ETA, but I think I can say that we're getting notably closer to a release :)
In the meantime the workaround #2757 (comment) still works fine for me - pip will complain about the dependency clash but will still install the newer version as requested. As long as the newer version doesn't introduce changes that are incompatible with PTB, you're good to go.

@trooz trooz mentioned this issue Apr 12, 2022
Closed
@trooz
Copy link
trooz commented Apr 12, 2022

I have the same issue. See Flexget/Flexget#2749

@Bibo-Joshi
Copy link
Member

closed on the v14 branch via #2958.

@Bibo-Joshi Bibo-Joshi mentioned this issue May 5, 2022
Closed
@github-actions github-actions bot locked and limited conversation to collaborators May 10, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
v20.0a0
Development

No branches or pull requests
4 participants
@xmatthias @tdudz @Bibo-Joshi @trooz
0