pip: Conflicting dependencies culprit is not displayed

Description

I have a project with two packages. I upgraded their dependencies on databind.core and databind.json from >=0.8.0,<=1.0.0 to >=1.1.0,<2.0.0. I.e. in the setup.py of both packages, the install reqs are listed as

  'databind.json >=1.1.0,<2.0.0',
  'databind.core >=1.1.0,<2.0.0',

Now installing the packages again in develop mode gives me:

$ pip install -v -e spam-bot/ -e spam-bot-predicate-comments/
[ ... ]

The conflict is caused by:
    spam-bot 0.4.2 depends on databind.core<2.0.0 and >=1.1.0
    spam-bot-predicate-comments 0.4.2 depends on databind.core<2.0.0 and >=1.1.0
    databind-json 1.2.0 depends on databind.core<2.0.0 and >=1.2.0
    spam-bot 0.4.2 depends on databind.core<2.0.0 and >=1.1.0
    spam-bot-predicate-comments 0.4.2 depends on databind.core<2.0.0 and >=1.1.0
    databind-json 1.1.6 depends on databind.core<2.0.0 and >=1.1.6
    spam-bot 0.4.2 depends on databind.core<2.0.0 and >=1.1.0
    spam-bot-predicate-comments 0.4.2 depends on databind.core<2.0.0 and >=1.1.0
    databind-json 1.1.5 depends on databind.core<2.0.0 and >=1.1.5
    spam-bot 0.4.2 depends on databind.core<2.0.0 and >=1.1.0
    spam-bot-predicate-comments 0.4.2 depends on databind.core<2.0.0 and >=1.1.0
    databind-json 1.1.4 depends on databind.core<2.0.0 and >=1.1.4
    spam-bot 0.4.2 depends on databind.core<2.0.0 and >=1.1.0
    spam-bot-predicate-comments 0.4.2 depends on databind.core<2.0.0 and >=1.1.0
    databind-json 1.1.3 depends on databind.core<2.0.0 and >=1.1.3
    spam-bot 0.4.2 depends on databind.core<2.0.0 and >=1.1.0
    spam-bot-predicate-comments 0.4.2 depends on databind.core<2.0.0 and >=1.1.0
    databind-json 1.1.2 depends on databind.core<2.0.0 and >=1.1.2
    spam-bot 0.4.2 depends on databind.core<2.0.0 and >=1.1.0
    spam-bot-predicate-comments 0.4.2 depends on databind.core<2.0.0 and >=1.1.0
    databind-json 1.1.1 depends on databind.core<2.0.0 and >=1.1.1

To fix this you could try to:
1. loosen the range of package versions you've specified
2. remove package versions to allow pip attempt to solve the dependency conflict

ERROR: ResolutionImpossible: for help visit https://pip.pypa.io/en/latest/user_guide/#fixing-conflicting-dependencies

(Full logs: pip_install_logs_21_1_3.txt, pip_install_logs_21_2_4.txt)

But I don’t see how this is a conflict.

• spam-bot 0.4.2 depends on databind.core<2.0.0 and >=1.1.0 *spam-bot-predicate-comments 0.4.2 depends on databind.core<2.0.0 and >=1.1.0

Ok they both depend on databind.core with the same version cosntraint.

• databind-json 1.2.0 depends on databind.core<2.0.0 and >=1.2.0

The version constraint of databind.json is slightly stricter, but would all three constraints are satisfiable with databind.core 1.2.0.

Now it turns out that thsi is an issue because there is also a requirement on databind.yaml >=0.1.2,<1.0.0 in the setup files which I did not notice earlier. That package is not compatible with databind.json or databind.core in those versions. Removing this package as a requirement resolves the conflict.

However the confusing this is that databind.yaml does not actually show up in the conflict error message at all.

Expected behavior

Pip is able to install the dependencies, in this case in version 1.2.0 for both databind.core and databind.json (latest on PyPI).

pip version

21.1.3, 21.2.4

Python version

3.9.6

OS

OSX

How to Reproduce

1. Install a package with the below setup file:

   import setuptools
   setuptools.setup(
     name='pkgb',
     version='0.0.0',
     install_requires=[
       'databind.json >=0.9.0,<1.0.0',
       'databind.core >=0.8.0,<1.0.0',
       'databind.yaml >=0.1.2,<1.0.0'
     ]
   )
   

    $ pip install .
   

2. Update the requirements for databind.core and databind.json and install again.

   import setuptools
   setuptools.setup(
     name='pkgb',
     version='0.0.0',
     install_requires=[
       'databind.json >=1.1.0,<2.0.0',
       'databind.core >=1.1.0,<2.0.0',
       'databind.yaml >=0.1.2,<1.0.0'
     ]
   )
   

    $ pip install .
   

3. Notice the conflict error but that it doesn’t show the conflict with databind.yaml at all.

   ERROR: Cannot install pkgb and pkgb==0.0.0 because these package versions have conflicting dependencies.
   
   The conflict is caused by:
       pkgb 0.0.0 depends on databind.core<2.0.0 and >=1.1.0
       databind-json 1.2.0 depends on databind.core<2.0.0 and >=1.2.0
       pkgb 0.0.0 depends on databind.core<2.0.0 and >=1.1.0
       databind-json 1.1.6 depends on databind.core<2.0.0 and >=1.1.6
       pkgb 0.0.0 depends on databind.core<2.0.0 and >=1.1.0
       databind-json 1.1.5 depends on databind.core<2.0.0 and >=1.1.5
       pkgb 0.0.0 depends on databind.core<2.0.0 and >=1.1.0
       databind-json 1.1.4 depends on databind.core<2.0.0 and >=1.1.4
       pkgb 0.0.0 depends on databind.core<2.0.0 and >=1.1.0
       databind-json 1.1.3 depends on databind.core<2.0.0 and >=1.1.3
       pkgb 0.0.0 depends on databind.core<2.0.0 and >=1.1.0
       databind-json 1.1.2 depends on databind.core<2.0.0 and >=1.1.2
       pkgb 0.0.0 depends on databind.core<2.0.0 and >=1.1.0
       databind-json 1.1.1 depends on databind.core<2.0.0 and >=1.1.1
   
   To fix this you could try to:
   1. loosen the range of package versions you've specified
   2. remove package versions to allow pip attempt to solve the dependency conflict
   

Output

No response

Code of Conduct

• I agree to follow the PSF Code of Conduct.