Declaring extras in constraints file installs also extra dependencies even if not instructed to

[tuukkamustonen]

Environment

• pip version: 19.1.1
• Python version: 3.7.2
• OS: KDE Neon

Description

In constraints file, when declaring a package with extras, all the dependencies of it get installed, even if actual requirement does not declare extras.

How to Reproduce

echo "requests[security]==2.20.1" > constraints.txt
pip install -c constraints.txt requests

Output

This installs not only direct requests dependencies:

Installing collected packages: chardet, certifi, idna, urllib3, requests

But also [security] extras:

Installing collected packages: idna, chardet, certifi, urllib3, six, pycparser, cffi, asn1crypto, cryptography, pyOpenSSL, requests

Expected behavior

pip should install only direct dependencies, even if extras are declared in constraints file.

---

This is such a simple case and easy to reproduce, it must be expected behavior. But why? And where is it documented?

[brainwane]

@pfmoore @pradyunsg @uranusjr Do we need to resolve this before the 20.2b2, or do we just need to put a "known bug" item about it in the "migrating to the new resolver" guide?

[uranusjr]

I believe this already does not work in the new resolver (it rejects the constraints file immediately). This is worth a mention in the guide, along with other changes we made to constraints, but it shouldn’t be categorised as a bug, but a behavioural difference IMO. This issue is describing a “bug” in the old resolver that the new one does not have, but some may consider this is a feature the new resolver doesn’t (and won’t) implement

[pfmoore]

@uranusjr Is correct. This is a completely intentional change in constraints for the new resolver. I do think it needs clearly calling out in the release notes, though, as it's definitely a behaviour change and we'd need to get feedback on how it impacts people.

[brainwane]

Am addressing in #8491.

[brainwane]

@pradyunsg @pfmoore @uranusjr ok to close this or rename it?

[pradyunsg]

OK to close, given that we don't allow this form with the new resolver.

[uranusjr]

Closing since #8491 is merged and there’s not much else to do here.