• pip exits with success despite incompatible constraint pypa/pip#6969

The bot created this issue to inform you that pyup.io has been set up on this repo.
Once you have closed it, the bot will open pull requests for updates as soon as they are available.

Didactic library

This should install numpy==1.14.0 but it doesn't:

classDiagram

pkgA --|> pkgB
pkgA --|> numpy
pkgA : numpy>=1.14.0
pkgA : pkgB

pkgB : numpy==1.14.0
numpy : whatever

conda create -n tst2 python=3.6 pip=18 -y
conda activate tst2

git clone https://github.com/KikeM/pkgA.git
git clone https://github.com/mmngreco/pkgB.git

cat pkgA/setup.py
cat pkgB/setup.py

pip install pkgA/. --process-dependency-links -I --no-cache-dir
pip freeze | grep numpy  # numpy==1.17.1 ??

This should crash installation process but it doesn't with incompatible versions of numpy.

classDiagram

pkgA --|> pkgB
pkgA --|> numpy
pkgA : numpy>=1.14.0
pkgA : pkgB

pkgB : numpy==1.13.0
numpy : whatever

cd pkgA
git checkout crash  # pkgA

cd ../pkgB
git checkout crash  # pkgB
cd ..

cat pkgA/setup.py
cat pkgB/setup.py

pip install pkgA/. --process-dependency-links -I --no-cache-dir
pip freeze | grep numpy  # numpy==1.17.1

The best and most direct workaround this dependencies issue is to fork pip and solve it.

Difficulty: Hard.
Scalability: Big.

The second best workaround is to use the tools within pip: pip check.

This tool provides the user with a report on compatibility among the different versions of the installed libraries. Additionally, it sends an integer to the standard error. Therefore, this can provide an easy way to implement an automatic test that guarantees the sanity of the environment.