broken release: pypi release 4.0.7 has 4.0.8 tgz/wheel about decorator HOT 6 CLOSED

I messed up with PyPI. I have just released version 4.0.9 which is identical to 4.0.7 and 4.0.8 but has the right name.

from decorator.

Unfortunately the new dependency solver in pip introduced in 20.3 chokes on this mispackaging.

It made the installation of Spyder fail: spyder-ide/spyder#14365

It would be best if you "yank" those releases to let pip know it is better to not use these, but don't break other people's build that have pinned this:

https://www.python.org/dev/peps/pep-0592/

from decorator.

I did not know about "yanking". It is a very useful feature indeed. Thanks for pointing the issue out, version 4.0.7 is yanked now.

from decorator.

Well, "yanking" did not exist in 2016! But you forgot to yank 4.0.8 as well.

from decorator.

I did not forget, 4.0.8 was even more broken, with the files missing on PyPI, so I just removed it. BTW, I do not understand why spyder is using a version of 4 years ago, given that there are newer versions totally compatible with the past. I guess it is IPython or numpy or some other of your dependencies which is listing explicitly an old version of the module.

from decorator.

Ah.. pip seems indeed to install this correctly. So thank you!

The problem is not that pip chooses to install such an old version, but it seems it wants to introspect all possible versions for a package to decide and than to install what is the best one to install.

And well, as far as I could see by inspecting the dependency tree of Spyder none of the dependencies specify any version of this package explicitly. So, any dependency resolver should just install the latest version instead. However, the new dependency resolver of pip seemingly does not have this shortcut build in. (They hopefully do that in the future.)

So, it goes ahead and introspects all possible versions anyway. Which include downloading it all en verifying them apparently.

And seemingly it will just completely abort mission if any of the old versions are mispackaged. Would have been better if it just skips those I guess, but hopefully another thing that will be included. Additionally, I would presume that a dependency resolver does not have to go trough years of old packages. It should just loop over the newest versions and stop immediately if any of the newest versions suffices the requirements.

from decorator.