dapacruz / panw-utils Goto Github PK

Hi, as shown in the following full dependency graph of panw-utils, panw-utils requires cryptography ==2.7, _ netmiko_ requires paramiko >=2.4.3 (paramiko 2.7.1 will be installed, i.e., the newest version satisfying the version constraint), and directed dependency paramiko 2.7.1 transitively introduces cryptography >=2.5.

Obviously, there are multiple version constraints set for cryptography in this project. However, according to pip's “first found wins” installation strategy, cryptography 1.2.1 (i.e., the newest version satisfying constraint ==2.7) is the actually installed version.

Although the first found package version cryptography 1.2.1 just satisfies the later dependency constraint （cryptography ==2.7), such installed version is very close to the upper bound of the version constraint of cryptography specified by paramiko 2.7.1.

Once paramiko upgrades，its newest version will be installed, as panw-utils does not specify the upper bound of version constraint for paramiko. Therefore, it will easily cause a dependency conflict (build failure), if the upgraded paramiko version introduces a higher version of cryptography, violating its another version constraint ==2.7.

According to the release history of paramiko, it habitually upgrates Cryptography in its recent releases. For instance, paramiko 2.3.0 upgrated Cryptography’s constraint from >=1.1 to >=1.5,and paramiko 2.5.0 upgrated Cryptography’s constraint from >=1.5 to >=2.5.

As such, it is a warm warning of a potential dependency conflict issue for panw-utils.

Dependency tree

panw-utils - 0.5.9
| +- cryptography(install version:2.7 version range:==2.7)
| +- netmiko(install version:2.4.2 version range:==2.4.2)
| | +- enum34(install version:1.1.10 version range:*)
| | +- ipaddress(install version:1.0.23 version range:*)
| | +- paramiko(install version:2.7.1 version range:>=2.4.3)
| | | +- bcrypt(install version:3.1.7 version range:>=3.1.3)
| | | +- cryptography(install version:2.7 version range:>=2.5)
| | | +- pynacl(install version:1.3.0 version range:>=1.0.1)
| | | | +- six(install version:1.14.0 version range:*)
| | +- pyserial(install version:3.4 version range:*)
| | +- scp(install version:0.13.2 version range:>=0.13.2)
| | | +- paramiko(install version:2.7.1 version range:*)
| | | | +- bcrypt(install version:3.1.7 version range:>=3.1.3)
| | | | +- cryptography(install version:2.7 version range:>=2.5)
| | | | +- pynacl(install version:1.3.0 version range:>=1.0.1)
| | +- setuptools(install version:46.1.3 version range:>=38.4.0)
| | +- textfsm(install version:1.1.0 version range:*)
| | | +- future(install version:0.18.2 version range:*)
| | | +- six(install version:1.14.0 version range:*)

Thanks for your help.
Best,
Neolith