pip-audit: Incompatibility with packaging>=22.0: cannot import name 'LegacyVersion' from 'packaging.version'
Bug description
pip-audit is incompatible with latest version of packaging, due to removed LegacyVersion
Reproduction steps
pip install pip-audit- Check that
packagingversion is >= 22.0 - Run
pip freeze | pip-audit --no-deps -r -to check the currently installed packages
Expected behavior
pip-audit installs a compatible version of packaging
Screenshots and logs
Traceback (most recent call last):
File "/usr/local/bin/pip-audit", line 5, in <module>
from pip_audit._cli import audit
File "/usr/local/lib/python3.9/site-packages/pip_audit/_cli.py", line 17, in <module>
from pip_audit._audit import AuditOptions, Auditor
File "/usr/local/lib/python3.9/site-packages/pip_audit/_audit.py", line 10, in <module>
from pip_audit._dependency_source import DependencySource
File "/usr/local/lib/python3.9/site-packages/pip_audit/_dependency_source/__init__.py", line 14, in <module>
from .requirement import RequirementSource
File "/usr/local/lib/python3.9/site-packages/pip_audit/_dependency_source/requirement.py", line 19, in <module>
from pip_requirements_parser import InstallRequirement, InvalidRequirementLine, RequirementsFile
File "/usr/local/lib/python3.9/site-packages/pip_requirements_parser.py", line 73, in <module>
from packaging.version import LegacyVersion
ImportError: cannot import name 'LegacyVersion' from 'packaging.version' (/usr/local/lib/python3.9/site-packages/packaging/version.py)
Platform information
- OS name and version: docker, python:3.9-alpine
pip-auditversion (pip-audit -V): 2.4.7- Python version (
python -Vorpython3 -V): 3.9.15 pipversion (pip -Vorpip3 -V): 22.0.4
About this issue
- Original URL
- State: closed
- Created 2 years ago
- Comments: 15 (10 by maintainers)
Cut as 2.4.9. Thanks again!
Got it, thanks for explaining! In that case we can push another patch out; I’ll do that in a moment.
It’s in
pip-requirements-parser. I’m looking into it @di.I think we might want to pursue dropping support for
LegacyVersioninstead? Going to reopen this to investigate.