Incompatibility with packaging>=22.0: cannot import name 'LegacyVersion' from 'packaging.version'

[haydngreatnews]

Bug description

pip-audit is incompatible with latest version of packaging, due to removed LegacyVersion

Reproduction steps

1. pip install pip-audit
2. Check that packaging version is >= 22.0
3. Run pip freeze | pip-audit --no-deps -r - to check the currently installed packages

Expected behavior

pip-audit installs a compatible version of packaging

Screenshots and logs

Traceback (most recent call last):
  File "/usr/local/bin/pip-audit", line 5, in <module>
    from pip_audit._cli import audit
  File "/usr/local/lib/python3.9/site-packages/pip_audit/_cli.py", line 17, in <module>
    from pip_audit._audit import AuditOptions, Auditor
  File "/usr/local/lib/python3.9/site-packages/pip_audit/_audit.py", line 10, in <module>
    from pip_audit._dependency_source import DependencySource
  File "/usr/local/lib/python3.9/site-packages/pip_audit/_dependency_source/__init__.py", line 14, in <module>
    from .requirement import RequirementSource
  File "/usr/local/lib/python3.9/site-packages/pip_audit/_dependency_source/requirement.py", line 19, in <module>
    from pip_requirements_parser import InstallRequirement, InvalidRequirementLine, RequirementsFile
  File "/usr/local/lib/python3.9/site-packages/pip_requirements_parser.py", line 73, in <module>
    from packaging.version import LegacyVersion
ImportError: cannot import name 'LegacyVersion' from 'packaging.version' (/usr/local/lib/python3.9/site-packages/packaging/version.py)

Platform information

• OS name and version: docker, python:3.9-alpine
• pip-audit version (pip-audit -V): 2.4.7
• Python version (python -V or python3 -V): 3.9.15
• pip version (pip -V or pip3 -V): 22.0.4

[di]

I think we might want to pursue dropping support for LegacyVersion instead? Going to reopen this to investigate.

[di]

(If this is due to vendored code from pip, we might want to do whatever pip is now doing instead).

[tetsuo-cpp]

It's in pip-requirements-parser. I'm looking into it @di.

[woodruffw]

It might also make sense to get a patch release out the door for #427, since pip install pip-audit is probably selecting the wrong packaging version currently.

Edit: Never mind, you read my mind 😅

[juanitosvq]

Thanks for the quick turnaround for this. Is there an estimate for when this PR #429 will be released?
Cheers,
Juan

[woodruffw]

Thanks for the quick turnaround for this. Is there an estimate for when this PR #429 will be released?

We'll probably do it with the next bugfix release, which will most likely be after a fix for #433 is merged.

Are you currently experiencing breakage? Both pip-requirments-parser and the latest release of pip-audit (2.4.8) should already have fixes for this, via #427 🙂

[juanitosvq]

Not quite breakage, but due to how pipenv works (pypa/pipenv#5528 for more details and example), we have to pin the version of packaging explicitly in our main packages section until #429 is available, which is not very pretty.