为什么 pip 安装了不兼容的软件包版本？

Question

我在 Ubuntu 上使用 pip 20.0.2，并从需求文件中安装了一堆需求。出于某种原因，pip 决定安装idna==2.9(link)，即使这与我直接列出的依赖项之一不兼容。所以我python -m pipdeptree -r在我正在安装所有东西的 virtualenv 中使用，我看到以下列出了idna：

idna==2.9                                         
  - cryptography==2.3.1 [requires: idna>=2.1]
  - requests==2.22.0 [requires: idna>=2.5,<2.9]
    - requests-oauthlib==1.3.0 [requires: requests>=2.0.0]
      - social-auth-core==3.2.0 [requires: requests-oauthlib>=0.6.1]
        - social-auth-app-django==2.1.0 [requires: social-auth-core>=1.2.0]
    - responses==0.10.9 [requires: requests>=2.0]
    - social-auth-core==3.2.0 [requires: requests>=2.9.1]                           
      - social-auth-app-django==2.1.0 [requires: social-auth-core>=1.2.0]

正如我们所见，我的两个直接依赖项（cryptography和requests）是 require idna。根据那些，看起来 pip 应该决定安装2.8，因为它是满足约束的最新版本。

为什么 pip 而不是安装idna2.9，如该输出的第一行所示，以及运行时的此错误消息pip install -r requirements.txt：

ERROR: requests 2.22.0 has requirement idna<2.9,>=2.5, but you'll have idna 2.9 which is incompatible.

编辑：requirements.txt 的内容及其子项，如评论中所要求：

# requirements.txt
-r requirements/requirements-base.txt
-r requirements/requirements-testing.txt

# requirements-base.txt
cryptography~=2.3.1
pyjwt~=1.6.4
requests~=2.22.0
social-auth-app-django~=2.1.0

# requirements-testing.txt
hypothesis~=3.87.0
pytest~=3.6.2
pytest-django~=3.3.2
pytest-cov~=2.5.1
responses~=0.10.5

编辑 2：我创建了一个最小可行的示例。对于这个例子，这里是 requirements.txt：

cryptography~=2.3.1
requests~=2.22.0

这是我在新目录中从头到尾运行的命令：

virtualenv -p python3.6 -v venv
source venv/bin/activate
pip install -r requirements.txt --no-cache-dir

以及完整的输出：

Collecting cryptography~=2.3.1
  Downloading cryptography-2.3.1-cp34-abi3-manylinux1_x86_64.whl (2.1 MB)
     |????????????????????????????????| 2.1 MB 2.0 MB/s 
Collecting requests~=2.22.0
  Downloading requests-2.22.0-py2.py3-none-any.whl (57 kB)
     |????????????????????????????????| 57 kB 18.5 MB/s 
Collecting asn1crypto>=0.21.0
  Downloading asn1crypto-1.3.0-py2.py3-none-any.whl (103 kB)
     |????????????????????????????????| 103 kB 65.4 MB/s 
Collecting idna>=2.1
  Downloading idna-2.9-py2.py3-none-any.whl (58 kB)
     |????????????????????????????????| 58 kB 71.4 MB/s 
Collecting six>=1.4.1
  Downloading six-1.14.0-py2.py3-none-any.whl (10 kB)
Collecting cffi!=1.11.3,>=1.7
  Downloading cffi-1.14.0-cp36-cp36m-manylinux1_x86_64.whl (399 kB)
     |????????????????????????????????| 399 kB 30.3 MB/s 
Collecting urllib3!=1.25.0,!=1.25.1,<1.26,>=1.21.1
  Downloading urllib3-1.25.8-py2.py3-none-any.whl (125 kB)
     |????????????????????????????????| 125 kB 46.7 MB/s 
Collecting certifi>=2017.4.17
  Downloading certifi-2019.11.28-py2.py3-none-any.whl (156 kB)
     |????????????????????????????????| 156 kB 65.1 MB/s 
Collecting chardet<3.1.0,>=3.0.2
  Downloading chardet-3.0.4-py2.py3-none-any.whl (133 kB)
     |????????????????????????????????| 133 kB 60.8 MB/s 
Collecting pycparser
  Downloading pycparser-2.19.tar.gz (158 kB)
     |????????????????????????????????| 158 kB 25.0 MB/s 
Building wheels for collected packages: pycparser
  Building wheel for pycparser (setup.py) ... done
  Created wheel for pycparser: filename=pycparser-2.19-py2.py3-none-any.whl size=111031 sha256=030a1449dd5902f2f03e9e2f8f9cc6760503136a9243e965237a1ece1196502a
  Stored in directory: /tmp/pip-ephem-wheel-cache-c_dx8qi5/wheels/c6/6b/83/2608afaa57ecfb0a66ac89191a8d9bad71c62ca55ee499c2d0
Successfully built pycparser
ERROR: requests 2.22.0 has requirement idna<2.9,>=2.5, but you'll have idna 2.9 which is incompatible.
Installing collected packages: asn1crypto, idna, six, pycparser, cffi, cryptography, urllib3, certifi, chardet, requests
Successfully installed asn1crypto-1.3.0 certifi-2019.11.28 cffi-1.14.0 chardet-3.0.4 cryptography-2.3.1 idna-2.9 pycparser-2.19 requests-2.22.0 six-1.14.0 urllib3-1.25.8

Answer 1

Pip 没有依赖解析器。如果您告诉它在foo没有任何资格的情况下安装软件包，您将获得最新版本的foo，即使它与您已经安装的其他软件包发生冲突。

存在其他解决方案，如诗歌，它们确实具有保持一切兼容的逻辑。如果您需要这个，请考虑使用类似的东西而不是普通的 pip。