Upgrade specific package to a specific version fails to pick up the version constraint

[slykar]

It seems like the version constraint for a package when using the -P option is ignored.
I ran the pip-compile -v -P pytest==3.0.5 and on the first run it says:

found candidate pytest==3.5.0 (constraint was <any>)

Environment Versions

1. Ubuntu 16.04
2. Python version: Python 3.6.4
3. pip version: pip 9.0.1
4. pip-tools version: pip-compile, version 1.11.0

Steps to replicate

1. create requirements.in file with pytest
2. create requirements.txt file with pytest==3.0.4
3. run pip-compile -P pytest==3.0.5

Expected result

[...]
pytest==3.0.5
[...]

Actual result

[...]
pytest==3.5.0
[...]

[vphilippon]

Hi @slykar, that's true, -P only specifies which packages should be upgraded even if valid existing pins are found in the requirements.txt. pytest==3.0.5 would actually be an invalid input right now, but the way pip-compile parses it, it accepts it and only keeps the name of the package. If you want to upgrade to a specific version, you can pin it in the requirements.in.

If you'd like to see -P/--upgrade-package take the version into account, I'm open to see a PR for that!

[slykar]

@vphilippon if that's true, then I might have misunderstood the README file?

$ pip-compile -P flask -P requests==2.0.0  # update the flask package to the latest, and requests to v2.0.0

Note the requests package example.

[vphilippon]

Uh! That example is not going to work indeed, that slipped through, sorry about that. I'm pretty sure pip-compile never had this behavior either.

So we should either fix the README, or make this work, because that actually seem like a neat feature.

[slykar]

For now I can only update the README file. If I find the time I would be happy to implement this.

Edit:

If you want to upgrade to a specific version, you can pin it in the requirements.in.

I think I had the same issue with this approach, but can't recall it right now.
I'll probably try again tomorrow, as I'm in a process of updating some project dependencies step by step.

[cdosborn]

If you don't specifically want the pin, you can temporarily pin the requirements.in, generate the requirements.txt, and then remove the pin.

[richafrank]

@vphilippon Closable from #694 ?

[atugushev]

Fixed in #694.