pipenv cannot resolve my dependencies

[skorokithakis]

pipenv fails to resolve my dependencies, showing a spurious dependency even though it does not show up in the dependency graph:

stavros@zeus:~/C/P/wshlst-server (master|✚4) 
00:18:52 $ pipenv install
Pipfile.lock not found, creating…
Locking [dev-packages] dependencies…
Locking [packages] dependencies…

Warning: Your dependencies could not be resolved. You likely have a mismatch in your sub-dependencies.
  You can use $ pipenv install --skip-lock to bypass this mechanism, then run $ pipenv graph to inspect the situation.
Could not find a version that matches cryptography<1.0,>=1.7.2,>=1.8.1,>=1.8.2,>=1.9
Tried: 0.1, 0.2, 0.2, 0.2, 0.2, 0.2, 0.2.1, 0.2.1, 0.2.1, 0.2.1, 0.2.1, 0.2.2, 0.2.2, 0.2.2, 0.2.2, 0.2.2, 0.3, 0.3, 0.3, 0.3, 0.3, 0.3, 0.4, 0.4, 0.4, 0.4, 0.4, 0.4, 0.4, 0.4, 0.4, 0.4, 0.4, 0.5, 0.5, 0.5, 0.5, 0.5, 0.5, 0.5, 0.5, 0.5, 0.5, 0.5, 0.5.1, 0.5.1, 0.5.1, 0.5.1, 0.5.1, 0.5.1, 0.5.1, 0.5.1, 0.5.1, 0.5.1, 0.5.1, 0.5.2, 0.5.2, 0.5.2, 0.5.2, 0.5.2, 0.5.2, 0.5.2, 0.5.2, 0.5.2, 0.5.2, 0.5.2, 0.5.3, 0.5.3, 0.5.3, 0.5.3, 0.5.3, 0.5.3, 0.5.3, 0.5.3, 0.5.3, 0.5.3, 0.5.3, 0.5.4, 0.5.4, 0.5.4, 0.5.4, 0.5.4, 0.5.4, 0.5.4, 0.5.4, 0.5.4, 0.5.4, 0.5.4, 0.6, 0.6, 0.6, 0.6, 0.6, 0.6, 0.6, 0.6, 0.6, 0.6, 0.6, 0.6.1, 0.6.1, 0.6.1, 0.6.1, 0.6.1, 0.6.1, 0.6.1, 0.6.1, 0.6.1, 0.6.1, 0.6.1, 0.7, 0.7, 0.7, 0.7, 0.7, 0.7, 0.7, 0.7, 0.7, 0.7, 0.7, 0.7.1, 0.7.1, 0.7.1, 0.7.1, 0.7.1, 0.7.1, 0.7.1, 0.7.1, 0.7.1, 0.7.1, 0.7.1, 0.7.2, 0.7.2, 0.7.2, 0.7.2, 0.7.2, 0.7.2, 0.7.2, 0.7.2, 0.7.2, 0.7.2, 0.7.2, 0.8, 0.8, 0.8, 0.8, 0.8, 0.8, 0.8, 0.8, 0.8, 0.8, 0.8, 0.8.1, 0.8.1, 0.8.1, 0.8.1, 0.8.1, 0.8.1, 0.8.1, 0.8.1, 0.8.1, 0.8.1, 0.8.1, 0.8.2, 0.8.2, 0.8.2, 0.8.2, 0.8.2, 0.8.2, 0.8.2, 0.8.2, 0.8.2, 0.8.2, 0.8.2, 0.9, 0.9, 0.9, 0.9, 0.9, 0.9, 0.9, 0.9, 0.9, 0.9.1, 0.9.1, 0.9.1, 0.9.1, 0.9.1, 0.9.1, 0.9.1, 0.9.1, 0.9.1, 0.9.2, 0.9.2, 0.9.2, 0.9.2, 0.9.2, 0.9.2, 0.9.2, 0.9.2, 0.9.2, 0.9.3, 0.9.3, 0.9.3, 0.9.3, 0.9.3, 0.9.3, 0.9.3, 0.9.3, 0.9.3, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0.1, 1.0.1, 1.0.1, 1.0.1, 1.0.1, 1.0.1, 1.0.1, 1.0.1, 1.0.1, 1.0.1, 1.0.1, 1.0.1, 1.0.1, 1.0.1, 1.0.1, 1.0.1, 1.0.2, 1.0.2, 1.0.2, 1.0.2, 1.0.2, 1.0.2, 1.0.2, 1.0.2, 1.0.2, 1.0.2, 1.0.2, 1.0.2, 1.0.2, 1.0.2, 1.0.2, 1.0.2, 1.0.2, 1.1, 1.1, 1.1, 1.1, 1.1, 1.1, 1.1, 1.1, 1.1, 1.1, 1.1, 1.1, 1.1, 1.1, 1.1, 1.1, 1.1, 1.1.1, 1.1.1, 1.1.1, 1.1.1, 1.1.1, 1.1.1, 1.1.1, 1.1.1, 1.1.1, 1.1.1, 1.1.1, 1.1.1, 1.1.1, 1.1.1, 1.1.1, 1.1.1, 1.1.1, 1.1.1, 1.1.1, 1.1.1, 1.1.1, 1.1.2, 1.1.2, 1.1.2, 1.1.2, 1.1.2, 1.1.2, 1.1.2, 1.1.2, 1.1.2, 1.1.2, 1.1.2, 1.1.2, 1.1.2, 1.1.2, 1.1.2, 1.1.2, 1.1.2, 1.1.2, 1.1.2, 1.1.2, 1.1.2, 1.2, 1.2, 1.2, 1.2, 1.2, 1.2, 1.2, 1.2, 1.2, 1.2, 1.2, 1.2, 1.2, 1.2, 1.2, 1.2, 1.2, 1.2, 1.2, 1.2, 1.2, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 1.2.3, 1.2.3, 1.2.3, 1.2.3, 1.2.3, 1.2.3, 1.2.3, 1.2.3, 1.2.3, 1.2.3, 1.2.3, 1.2.3, 1.2.3, 1.2.3, 1.2.3, 1.2.3, 1.2.3, 1.2.3, 1.2.3, 1.2.3, 1.2.3, 1.3, 1.3, 1.3, 1.3, 1.3, 1.3, 1.3, 1.3, 1.3, 1.3, 1.3, 1.3, 1.3, 1.3, 1.3, 1.3, 1.3, 1.3, 1.3, 1.3, 1.3, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.1, 1.3.2, 1.3.2, 1.3.2, 1.3.2, 1.3.2, 1.3.2, 1.3.2, 1.3.2, 1.3.2, 1.3.2, 1.3.2, 1.3.2, 1.3.2, 1.3.2, 1.3.2, 1.3.2, 1.3.2, 1.3.3, 1.3.3, 1.3.3, 1.3.3, 1.3.3, 1.3.3, 1.3.3, 1.3.3, 1.3.3, 1.3.3, 1.3.3, 1.3.3, 1.3.3, 1.3.3, 1.3.3, 1.3.3, 1.3.3, 1.3.4, 1.3.4, 1.3.4, 1.3.4, 1.3.4, 1.3.4, 1.3.4, 1.3.4, 1.3.4, 1.3.4, 1.3.4, 1.3.4, 1.3.4, 1.3.4, 1.3.4, 1.3.4, 1.3.4, 1.3.4, 1.3.4, 1.3.4, 1.3.4, 1.3.4, 1.4, 1.4, 1.4, 1.4, 1.4, 1.4, 1.4, 1.4, 1.4, 1.4, 1.4, 1.4, 1.4, 1.4, 1.4, 1.4, 1.4, 1.4, 1.4, 1.4, 1.4, 1.4, 1.5, 1.5, 1.5, 1.5, 1.5, 1.5, 1.5, 1.5, 1.5, 1.5, 1.5, 1.5, 1.5, 1.5, 1.5, 1.5, 1.5, 1.5, 1.5, 1.5, 1.5, 1.5, 1.5.1, 1.5.1, 1.5.1, 1.5.1, 1.5.1, 1.5.1, 1.5.1, 1.5.1, 1.5.1, 1.5.1, 1.5.1, 1.5.1, 1.5.1, 1.5.1, 1.5.1, 1.5.1, 1.5.1, 1.5.1, 1.5.1, 1.5.1, 1.5.1, 1.5.1, 1.5.2, 1.5.2, 1.5.2, 1.5.2, 1.5.2, 1.5.2, 1.5.2, 1.5.2, 1.5.2, 1.5.2, 1.5.2, 1.5.2, 1.5.2, 1.5.2, 1.5.2, 1.5.2, 1.5.2, 1.5.2, 1.5.2, 1.5.2, 1.5.2, 1.5.2, 1.5.3, 1.5.3, 1.5.3, 1.5.3, 1.5.3, 1.5.3, 1.5.3, 1.5.3, 1.5.3, 1.5.3, 1.5.3, 1.5.3, 1.5.3, 1.5.3, 1.5.3, 1.5.3, 1.5.3, 1.5.3, 1.5.3, 1.5.3, 1.5.3, 1.5.3, 1.6, 1.6, 1.6, 1.6, 1.6, 1.6, 1.6, 1.6, 1.6, 1.6, 1.6, 1.6, 1.6, 1.6, 1.6, 1.6, 1.6, 1.6, 1.6, 1.6, 1.6, 1.6, 1.7, 1.7, 1.7, 1.7, 1.7, 1.7, 1.7, 1.7, 1.7, 1.7, 1.7, 1.7, 1.7, 1.7, 1.7, 1.7, 1.7, 1.7, 1.7, 1.7, 1.7, 1.7, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.2, 1.7.2, 1.7.2, 1.7.2, 1.7.2, 1.7.2, 1.7.2, 1.7.2, 1.7.2, 1.7.2, 1.7.2, 1.7.2, 1.7.2, 1.7.2, 1.7.2, 1.7.2, 1.7.2, 1.7.2, 1.7.2, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.9, 1.9, 1.9, 1.9, 1.9, 1.9, 1.9, 1.9, 1.9, 1.9, 1.9, 1.9, 1.9, 1.9, 1.9, 1.9, 1.9, 1.9, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.1, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.2, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.0.3, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.1, 2.1.2, 2.1.2, 2.1.2, 2.1.2, 2.1.2, 2.1.2, 2.1.2, 2.1.2, 2.1.2, 2.1.2, 2.1.2, 2.1.2, 2.1.2, 2.1.2, 2.1.2, 2.1.2, 2.1.2, 2.1.2, 2.1.2, 2.1.2, 2.1.2, 2.1.2, 2.1.2, 2.1.3, 2.1.3, 2.1.3, 2.1.3, 2.1.3, 2.1.3, 2.1.3, 2.1.3, 2.1.3, 2.1.3, 2.1.3, 2.1.3, 2.1.3, 2.1.3, 2.1.3, 2.1.3, 2.1.3, 2.1.3, 2.1.3, 2.1.3, 2.1.3, 2.1.3, 2.1.3, 2.1.4, 2.1.4, 2.1.4, 2.1.4, 2.1.4, 2.1.4, 2.1.4, 2.1.4, 2.1.4, 2.1.4, 2.1.4, 2.1.4, 2.1.4, 2.1.4, 2.1.4, 2.1.4, 2.1.4, 2.1.4, 2.1.4, 2.1.4, 2.1.4, 2.1.4, 2.1.4


stavros@zeus:~/C/P/wshlst-server (master|✚4) 
00:19:22 $ pipenv graph
curequests==0.4.0
  - curio [required: Any, installed: 0.9]
  - httptools [required: Any, installed: 0.0.10]
  - namedlist [required: Any, installed: 1.7]
  - requests [required: Any, installed: 2.18.4]
    - certifi [required: >=2017.4.17, installed: 2018.1.18]
    - chardet [required: >=3.0.2,<3.1.0, installed: 3.0.4]
    - idna [required: >=2.5,<2.7, installed: 2.6]
    - urllib3 [required: <1.23,>=1.21.1, installed: 1.22]
  - yarl [required: Any, installed: 1.1.1]
    - idna [required: >=2.0, installed: 2.6]
    - multidict [required: >=4.0, installed: 4.1.0]
django-extensions==2.0.5
  - six [required: >=1.2, installed: 1.11.0]
django-push-notifications==1.6.0
  - apns2 [required: >=0.3.0, installed: 0.3.0]
    - cryptography [required: >=1.7.2, installed: 2.1.4]
      - asn1crypto [required: >=0.21.0, installed: 0.24.0]
      - cffi [required: >=1.7, installed: 1.11.5]
        - pycparser [required: Any, installed: 2.18]
      - idna [required: >=2.1, installed: 2.6]
      - six [required: >=1.4.1, installed: 1.11.0]
    - hyper [required: >=0.7, installed: 0.7.0]
      - h2 [required: >=2.4,<3.0, installed: 2.6.2]
        - hpack [required: <4,>=2.2, installed: 3.0.0]
        - hyperframe [required: >=3.1,<6,!=4.0.0, installed: 3.2.0]
      - hyperframe [required: <4.0,>=3.2, installed: 3.2.0]
    - PyJWT [required: >=1.4.0, installed: 1.6.0]
  - Django [required: >=1.11, installed: 2.0.3]
    - pytz [required: Any, installed: 2018.3]
  - pywebpush [required: >=1.3.0, installed: 1.6.1]
    - cryptography [required: >=1.8.1, installed: 2.1.4]
      - asn1crypto [required: >=0.21.0, installed: 0.24.0]
      - cffi [required: >=1.7, installed: 1.11.5]
        - pycparser [required: Any, installed: 2.18]
      - idna [required: >=2.1, installed: 2.6]
      - six [required: >=1.4.1, installed: 1.11.0]
    - http-ece [required: >=1.0.1, installed: 1.0.5]
      - cryptography [required: >=1.9, installed: 2.1.4]
        - asn1crypto [required: >=0.21.0, installed: 0.24.0]
        - cffi [required: >=1.7, installed: 1.11.5]
          - pycparser [required: Any, installed: 2.18]
        - idna [required: >=2.1, installed: 2.6]
        - six [required: >=1.4.1, installed: 1.11.0]
    - py-vapid [required: >=1.3.0, installed: 1.3.0]
      - cryptography [required: >=1.8.2, installed: 2.1.4]
        - asn1crypto [required: >=0.21.0, installed: 0.24.0]
        - cffi [required: >=1.7, installed: 1.11.5]
          - pycparser [required: Any, installed: 2.18]
        - idna [required: >=2.1, installed: 2.6]
        - six [required: >=1.4.1, installed: 1.11.0]
      - ecdsa [required: ==0.13, installed: 0.13]
    - requests [required: >=2.13.0, installed: 2.18.4]
      - certifi [required: >=2017.4.17, installed: 2018.1.18]
      - chardet [required: >=3.0.2,<3.1.0, installed: 3.0.4]
      - idna [required: >=2.5,<2.7, installed: 2.6]
      - urllib3 [required: <1.23,>=1.21.1, installed: 1.22]
django-redis==4.9.0
  - Django [required: >=1.11, installed: 2.0.3]
    - pytz [required: Any, installed: 2018.3]
  - redis [required: >=2.10.0, installed: 2.10.6]
pipenv==11.6.8
  - certifi [required: Any, installed: 2018.1.18]
  - pip [required: >=9.0.1, installed: 9.0.1]
  - setuptools [required: >=36.2.1, installed: 38.5.2]
  - virtualenv [required: Any, installed: 15.1.0]
  - virtualenv-clone [required: >=0.2.5, installed: 0.3.0]
pkg-resources==0.0.0
psycopg2-binary==2.7.4
pytest-cov==2.5.1
  - coverage [required: >=3.7.1, installed: 4.5.1]
  - pytest [required: >=2.6.0, installed: 3.4.2]
    - attrs [required: >=17.2.0, installed: 17.4.0]
    - pluggy [required: <0.7,>=0.5, installed: 0.6.0]
    - py [required: >=1.5.0, installed: 1.5.2]
    - setuptools [required: Any, installed: 38.5.2]
    - six [required: >=1.10.0, installed: 1.11.0]
raven==6.6.0
schema==0.6.7
shortuuid==0.5.0
uWSGI==2.0.17
Werkzeug==0.14.1
whitenoise==3.3.1


stavros@zeus:~/C/P/wshlst-server (master|✚4) 
00:20:04 $ cat Pipfile 
[[source]]

url = "https://pypi.python.org/simple"
name = "pypi"
verify_ssl = true


[dev-packages]

ipython = "*"
bpython = "*"
pudb = "*"
"flake8" = "*"
isort = "*"
yapf = "*"


[packages]

django = "*"
django-extensions = "*"
"psycopg2-binary" = "*"
shortuuid = "*"
whitenoise = "*"
pytest = "*"
pytest-cov = "*"
raven = "*"
django-redis = "*"
werkzeug = "*"
uwsgi = "*"
schema = "*"
django-push-notifications = "*"
curio = "*"
curequests = "*"

[kennethreitz42]

You have an unresolvable dependency graph. Please read the error messages.

[skorokithakis]

I did read the error messages. I don't see cryptography<1.0 specified anywhere in the graph?

[kennethreitz42]

one of your dependencies declares it. We don't make things up.

I'd start checking setup.py's or running pipenv lock --verbose.

[kennethreitz42]

hyper==0.7.0 requires cryptography<1.0;

[kennethreitz42]

We really don't have time to be diagnosing dependency graph problems for people. This is your issue, you have the tools to figure it out :)

[skorokithakis]

I would agree, except this wasn't mentioned anywhere in pipenv graph, which was what pipenv pointed me to.

[kennethreitz42]

sorry the free software isn't meeting your expectations

[skorokithakis]

The hyper module only requires cryptography<1.0 for the PyPy platform, which I'm not running under. That dependency shouldn't be selected by pipenv:

https://pypi.python.org/pypi/hyper

[kennethreitz42]

we resolve the graph for all platforms.

[kennethreitz42]

our resolver is far from perfect, but it's the best we can do, given our current constraints.

[altimore]

Hello,

Small question here, I didn't find the answer in the doc.
When installing a package with pipenv it adds a "package" = "*" in the Pipfile, which always resolve to the latest version.
So if I install another package with a dependency to this package lower than the latest i get a conflict.
Is it the intended behavior ?

In my case the pillow package "pillow" = "*" resolve to ==5.2.0 and the django-versatileimagefield dependency to pillow resolve to <=5.0.0

Regards,

Alti.

[aelsibaie]

If running pipenv lock --verbose is the correct command to start investigating the problem then it should be included in the error message. Similarly to @skorokithakis I was looking through the graph and it was entirely unhelpful

[dashdanw]

@skorokithakis just as a followup (not sure if this was mentioned) the hyper/h2 version dependencies have been a continuing problem for me due to the fact that many libraries rely on severely outdated, non-backwards-compatible versions of hyperframe.
ie. https://github.com/jazzband/django-push-notifications/issues/520

Unfortunately pipenv isn't the cause, just the bearer of bad news for us! and, we should appreciate @ken-reitz and friends for putting the time in to improve these systems :)