Pip-tools: pip-compile adding appdirs, packaging etc. setuptools deps

[hyperknot]

Describe the issue briefly here.
Out of nowhere, on a new run of pip-compile it started adding the dependencies of setuptools. So appdirs, packaging, pyparsing (via packaging) tools are added.

Steps to replicate

Just run pip-compile.

Expected result

No dependencies of "via setuptools".

Actual result

Dependencies also listed of "via setuptools".

[jonafato]

It seems like this is the result of setuptools using setup.py for dependencies instead of vendoring them as of this commit. My naive guess (without reading through the logic for this exclusion) is that the full dependency graph, including all of the setuptools dependencies, is computed and then the setuptools dependency is removed rather than ignoring it when it's first seen.

[merwok]

Having appdirs in the compiled requirement files but not setuptools has been causing issues for me on CircleCI in the past weeks.

[hyperknot]

I also run into an error which brakes pip install. It was adding an _older_
appdir package than the one supplied with virtualenv which it couldn't
install.

On 2017. Feb 26., Sun at 21:41, Éric Araujo [e-mail]
wrote:

Having appdirs in the compiled requirement files but not setuptools has
been causing issues for me on CircleCI in the past weeks.

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/jazzband/pip-tools/issues/445#issuecomment-282585632,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AAeKjwud65taZgzOqj-Hc5KlNhWWPu4uks5rgeNigaJpZM4LxECN
.

[davidovich]

@jonafato I beleive your guess is correct, setuptools is removed in piptools/writer.py, which is too late to determine dependencies brought in by the unsafe setuptools.

Now that setuptools has external dependencies, we would need to bring the analysis early on in the resolving stage, and populate a kind of safety_ignore set. Other legitimate constraints could also contribute to remove an element from the safety_ignore, if they are needed by top-level or unrelated packages' sub-dependencies.

[suutari-ai]

I think commit afb3db6e9b05ba618e776baf7a9b5322e3a30e65 from PR #441 fixes this. Though it breaks --no-annotate, but there is a fix for it in commit abf25d8f1754dd3717519e339d0e727cfcc10633.

[MinchinWeb]

Has this been fixed in v1.8.1? My basic use of pip-tools seems to suggest it has...