Convert off pkg resources (#6139)

* Conversion off pkg_resources
* prepapre to vendor in latest pipdeptree
* Vendor in latest pipdeptree to solve some of the pkg_resources conversion errors.
* Convert outdated off pkg_resource to importlib.metadata.
* According to https://discuss.python.org/t/module-importlib-has-no-attribute-metadata/20947/10 I should remove this import.
* Try upgrading the setup-python actions
* vendor in importlib-metadata
* Use the vendored importlib-metadata
* Require zipp for the importlib_metadata vendoring
* prepare to vendor in zipp since the CI isolates this from the actual env where zipp got installed
* vendor in zipp since the CI isolates this from the actual env where zipp got installed
* Go with the version of importlib-metadata that targets the 3.11 sdlib
* 4.x had the same issue with python 3.8; until we drop it we may have to patch importlib-metadata version that we vendor.
* attempt to account for is_relative_to not available in py3.8
* pip's packaging version is behind what we need to work with pipdeptree
* modify patch for new version of pipdeptree
* Verify patch works now with revendoring
* add branch for 3.8 until we can drop support for it
* Adjust conditional and add news fragment
* Deduplicate code
* and safety is dependent on the pip's packaging version (for now).
* Handle inconsistency in graph output in this test for time being
* PR Feedback
* Fix our remaining usages (yes I found more)
* Skip this test on windows 3.8 -- 3.8 will be dropped end of the year anyway.

.github/workflows/ci.yaml

@@ -62,7 +62,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: 3.x
       - run: |
@@ -86,6 +86,7 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
           allow-prereleases: true
+          check-latest: true
 
       - name: Get python path
         id: python-path

Pipfile

@@ -19,7 +19,7 @@ typing-extensions = "==4.*"
 waitress = {version = "*", sys_platform = "== 'win32'"}
 gunicorn = {version = "*", sys_platform = "== 'linux'"}
 parse = "*"
-importlib-metadata = {version = "*"}
+importlib-metadata = "*"
 colorama= {version = "*", sys_platform = "== 'win32'"}
 myst-parser = {extras = ["linkify"], version = "*"}
 invoke = "*"

news/6139.bugfix.rst

@@ -0,0 +1,4 @@
+``pipenv`` converts off ``pkg_resources`` API usages.  This necessitated also vendoring in:
+* latest ``pipdeptree==2.18.1`` which also converted off ``pkg_resources``
+* ``importlib-metadata==6.5.1`` to continue supporting python 3.8 and 3.9
+* ``packaging==24.0`` since the packaging we were utilizing in pip's _vendor was insufficient for this conversion.