Dependency tree is broken on python3.7

[costastf]

Trying to install any of the 1.x versions through pipenv blows up since the dependency tree cannot be resolved.

Steps to reproduce:
pipenv install prospector

Outcome:

Locking [packages] dependencies…
Warning: Your dependencies could not be resolved. You likely have a mismatch in your sub-dependencies.
  You can use $ pipenv install --skip-lock to bypass this mechanism, then run $ pipenv graph to inspect the situation.
Could not find a version that matches pycodestyle<2.4.0,<2.5.0,>=2.0.0,>=2.4.0
Tried: 1.8.0.dev0, 1.8.0.dev0, 1.8.0.dev0, 1.8.0.dev0, 2.0.0a1, 2.0.0a1, 2.0.0a1, 2.0.0a1, 2.0.0, 2.0.0, 2.0.0, 2.0.0, 2.1.0, 2.1.0, 2.1.0, 2.1.0, 2.2.0, 2.2.0, 2.2.0, 2.2.0, 2.3.0, 2.3.0, 2.3.0, 2.3.0, 2.3.1, 2.3.1, 2.3.1, 2.3.1, 2.4.0, 2.4.0, 2.4.0, 2.4.0
Warning: Your dependencies could not be resolved. You likely have a mismatch in your sub-dependencies.
  You can use $ pipenv install --skip-lock to bypass this mechanism, then run $ pipenv graph to inspect the situation.
Could not find a version that matches pylint>=2
Tried: 0.15.2, 0.15.2, 0.16.0, 0.16.0, 0.18.0, 0.18.0, 0.18.1, 0.18.1, 0.19.0, 0.19.0, 0.20.0, 0.20.0, 0.21.0, 0.21.0, 0.21.1, 0.21.1, 0.21.2, 0.21.2, 0.21.3, 0.21.3, 0.22.0, 0.22.0, 0.23.0, 0.23.0, 0.24.0, 0.24.0, 0.25.0, 0.25.0, 0.25.1, 0.25.1, 0.25.2, 0.25.2, 0.26.0, 0.26.0, 0.27.0, 0.27.0, 0.28.0, 0.28.0, 1.0.0, 1.0.0, 1.1.0, 1.1.0, 1.2.0, 1.2.0, 1.2.1, 1.2.1, 1.3.0, 1.3.0, 1.3.1, 1.3.1, 1.4.0, 1.4.0, 1.4.0, 1.4.0, 1.4.1, 1.4.1, 1.4.1, 1.4.1, 1.4.2, 1.4.2, 1.4.2, 1.4.2, 1.4.3, 1.4.3, 1.4.3, 1.4.3, 1.4.4, 1.4.4, 1.4.4, 1.4.4, 1.4.5, 1.4.5, 1.4.5, 1.4.5, 1.5.0, 1.5.0, 1.5.0, 1.5.0, 1.5.1, 1.5.1, 1.5.1, 1.5.1, 1.5.2, 1.5.2, 1.5.2, 1.5.2, 1.5.3, 1.5.3, 1.5.3, 1.5.3, 1.5.4, 1.5.4, 1.5.4, 1.5.4, 1.5.5, 1.5.5, 1.5.5, 1.5.5, 1.5.6, 1.5.6, 1.5.6, 1.5.6, 1.6.0, 1.6.0, 1.6.0, 1.6.0, 1.6.1, 1.6.1, 1.6.1, 1.6.1, 1.6.2, 1.6.2, 1.6.2, 1.6.2, 1.6.3, 1.6.3, 1.6.3, 1.6.3, 1.6.4, 1.6.4, 1.6.4, 1.6.4, 1.6.5, 1.6.5, 1.6.5, 1.6.5, 1.7.0, 1.7.0, 1.7.0, 1.7.0, 1.7.1, 1.7.1, 1.7.1, 1.7.1, 1.7.2, 1.7.2, 1.7.2, 1.7.2, 1.7.3, 1.7.3, 1.7.3, 1.7.3, 1.7.4, 1.7.4, 1.7.4, 1.7.4, 1.7.5, 1.7.5, 1.7.5, 1.7.5, 1.7.6, 1.7.6, 1.7.6, 1.7.6, 1.8.0, 1.8.0, 1.8.0, 1.8.0, 1.8.1, 1.8.1, 1.8.1, 1.8.1, 1.8.2, 1.8.2, 1.8.2, 1.8.2, 1.8.3, 1.8.3, 1.8.3, 1.8.3, 1.8.4, 1.8.4, 1.8.4, 1.8.4, 1.9.0, 1.9.0, 1.9.0, 1.9.0, 1.9.1, 1.9.1, 1.9.1, 1.9.1, 1.9.2, 1.9.2, 1.9.2, 1.9.2, 1.9.3, 1.9.3, 1.9.3, 1.9.3```

[richardhanson]

So this appears to be an issue with the update to flake8. See the pep8-naming dependency trees below.

Working

pep8-naming [required: >=0.3.3, installed: 0.7.0]
- flake8-polyfill [required: >=1.0.2,<2, installed: 1.0.2]
  - flake8 [required: Any, installed: 3.5.0]
    - mccabe [required: >=0.6.0,<0.7.0, installed: 0.6.1]
    - pycodestyle [required: >=2.0.0,<2.4.0, installed: 2.3.1]
    - pyflakes [required: >=1.5.0,<1.7.0, installed: 1.6.0]

Not working

pep8-naming [required: >=0.3.3, installed: 0.7.0]
- flake8-polyfill [required: >=1.0.2,<2, installed: 1.0.2]
  - flake8 [required: Any, installed: 3.6.0]
    - mccabe [required: >=0.6.0,<0.7.0, installed: 0.6.1]
    - pycodestyle [required: >=2.4.0,<2.5.0, installed: 2.3.1]
    - pyflakes [required: >=2.0.0,<2.1.0, installed: 1.6.0]
    - setuptools [required: >=30, installed: 40.4.3]

You can add the following line above your prospector line in your Pipfile.
flake8 = "<3.6.0"

[carlio]

@richardhanson Thanks for looking into this, this is good info.

@chocoelho I think the easiest solution for us as maintainers is to use pinned versions or at least stricter ranges in our setup.py - the velocity of various dependencies has increased so there are lots and lots of new releases all the time...

[stanleykylee]

I just noticed this today as well when my builds suddenly broke. I've pinned flake8==3.5.0 for now. Is this an issue that should be followed up on prospector or the flake8 side of things?

[carlio]

@stanleykylee I think it's something prospector needs to fix, as the problem seems to come from various prospector dependencies having their own pinned versions and that's where conflicts come from. I'll try to figure out a new release for prospector pinning a known-good set of versions and then from now on I think we'll have to have stricter dependency definitions. Right now it lots have no upper bound so any downstream release can cause breaking changes.

[stanleykylee]

@carlio thanks for the reply. I'll keep my eye on this. If there's anything I can do to help, let me know. I'm still new to python and prospector has been great helping me keep our code quality checked!

[carlio]

version 1.1.4 is on pypi now, hopefully should fix this - let me know if you find any other problems!

[stanleykylee]

@carlio this still doesn't address the issue with flake8 3.6.0, I get the following

pip message

flake8 3.6.0 has requirement pycodestyle<2.5.0,>=2.4.0, but you'll have pycodestyle 2.3.1 which is incompatible.

flake8 3.6.0 has requirement pyflakes<2.1.0,>=2.0.0, but you'll have pyflakes 1.6.0 which is incompatible.

prospector 1.1.4 has requirement pep8-naming<=0.4.1,>=0.3.3, but you'll have pep8-naming 0.7.0 which is incompatible.

When running prospector, I get the following traceback.

Traceback

Traceback (most recent call last):
  File "/usr/local/lib/python3.6/site-packages/pkg_resources/__init__.py", line 578, in _build_master
    ws.require(__requires__)
  File "/usr/local/lib/python3.6/site-packages/pkg_resources/__init__.py", line 895, in require
    needed = self.resolve(parse_requirements(requirements))
  File "/usr/local/lib/python3.6/site-packages/pkg_resources/__init__.py", line 786, in resolve
    raise VersionConflict(dist, req).with_context(dependent_req)
pkg_resources.ContextualVersionConflict: (pep8-naming 0.7.0 (/usr/local/lib/python3.6/site-packages), Requirement.parse('pep8-naming<=0.4.1,>=0.3.3'), {'prospector'})

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/bin/prospector", line 6, in <module>
    from pkg_resources import load_entry_point
  File "/usr/local/lib/python3.6/site-packages/pkg_resources/__init__.py", line 3105, in <module>
    @_call_aside
  File "/usr/local/lib/python3.6/site-packages/pkg_resources/__init__.py", line 3089, in _call_aside
    f(*args, **kwargs)
  File "/usr/local/lib/python3.6/site-packages/pkg_resources/__init__.py", line 3118, in _initialize_master_working_set
    working_set = WorkingSet._build_master()
  File "/usr/local/lib/python3.6/site-packages/pkg_resources/__init__.py", line 580, in _build_master
    return cls._build_from_requirements(__requires__)
  File "/usr/local/lib/python3.6/site-packages/pkg_resources/__init__.py", line 593, in _build_from_requirements
    dists = ws.resolve(reqs, Environment())
  File "/usr/local/lib/python3.6/site-packages/pkg_resources/__init__.py", line 781, in resolve
    raise DistributionNotFound(req, requirers)
pkg_resources.DistributionNotFound: The 'pep8-naming<=0.4.1,>=0.3.3' distribution was not found and is required by prospector```

[carlio]

@stanleykylee you still have the old pep8-naming installed - try uninstalling that first then reinstalling prospector, or perhaps install prospector with '--upgrade' flag to get it to also update dependency versions?

[stanleykylee]

@carlio , you're right, I had pinned the other dependencies causing the issue. Thanks for pointing it out, it works now.