Hello,
Thank you for the feedback.
The issue I reported is not related to pkg_resources, which has indeed
deprecated for a few years. I used pkg_resources because the code was
short and showed version conflicts quickly.
The modern alternative to pkg_resources is importlib.metadata, which can
also show issues. For example the quickly-written following script will
list version conflicts:
#!/usr/bin/python3
import importlib.metadata
from packaging.requirements import Requirement
for d in importlib.metadata.distributions():
if not d.name:
continue
requires = importlib.metadata.requires(d.name)
requirements = [Requirement(req) for req in requires] if requires
else []
for r in requirements:
try:
v = importlib.metadata.distribution(r.name).version
except importlib.metadata.PackageNotFoundError:
# print(f"{d.name} requires {r.name}, which is not installed")
pass
else:
if not r.specifier.contains(v):
print(f"{d.name} requires {r.name} {r.specifier} but
{v} is installed")
On my computer, this will print for example:
h2 requires hpack <5,>=4.1 but 4.0.0 is installed
One can indeed check that python3-hpack 4.0.0-4 is installed in testing,
and that h2 requires a more recent version:
$ grep Requires-Dist
/usr/lib/python3/dist-packages/h2-4.3.0.dist-info/METADATA
Requires-Dist: hyperframe<7,>=6.1
Requires-Dist: hpack<5,>=4.1
The version conflict exists, pkg_resources was just a quick way among
others to list them.
The version conflicts may be harmless, for example packages that require
a different version of sphinx. But in the case of h2, one would think
that, if the maintainer took the time to specify that the version of
hpack must be greater than 4.1, it means h2 wouldn't work normally with
version 4.0.
In other cases, the required version even has a different major number
than the installed version, for example:
zstandard requires cffi ~=1.17 but 2.0.0 is installed
APScheduler requires protobuf <=3.21.0 but 4.21.12 is installed
eyed3 requires Pillow <10.0.0,>=8.0.1 but 12.3.0 is installed
arrow requires simplejson ==3.* but 4.1.1 is installed
uvloop requires pyOpenSSL ~=25.3.0 but 26.2.0 is installed
and many more. This may be harmless if the project is not using
semantic versioning, but if it does, it means that a package is
expecting a different API/ABI than what the installed dependency offers!
Again, this may not be a big deal, but I'd personally be quite scared if
I found such version conflicts in my own projects 🙂
If you still think this is not an issue, you may close this bug now. I
thought I ought to report it.
Thanks!
