v7.6.1

[sirosen]

Bug fixes

• Fixed handling of index URLs ending in /simple/ by improving URL normalization logic.
  These URLs would previously make pip-compile fail to use the PyPI JSON API.

  -- by @sirosen

  PRs and issues: Get hashes from PyPI JSON API fails when index URL ends with slash #1669

• Added a missing dependency on typing-extensions for Python 3.9 and 3.10
  -- by @sirosen.

  PRs and issues: 7.6.0 breaks minimum version requirement of python 3.9 #2424

Features

• pip-tools is now compatible with pip version 26.2 -- by @sirosen.

  PRs and issues: pip 26.2 : cannot import name "stdlib_pkgs" from "pip._internal.utils.compat" #2436, pip 26.2: RequirementCommand.make_requirement_preparer() missing 1 required keyword-only argument: 'allow_editables' #2437

Improved documentation

• pip-tools documentation now features a how-to section, featuring initial docs which cover controlling output file headers and configuring completion -- by @sirosen.

Contributor-facing changes

• Fixed CI triggers so that release tags won't create spurious failing runs -- by @sirosen.

  PRs and issues: Failing CI is triggered when release tags are pushed #2421

• Refactored the bug report template for better reporting -- by @psthindal.

---

This discussion was created from the release v7.6.1.

[juandspy]

Hey ,

pip-tools 7.6.1 breaks pybuild-deps 0.5.0 when using pybuild-deps compile.

We hit this in CI after 7.6.1 landed on PyPI (job was fine on 7.6.0 yesterday). For example, in https://github.com/RedHatInsights/lightspeed-advisor-on-premise-ocp/blob/15f55de98c460b763742bd80aa3a61e264faaf25/scripts/update_requirements.sh:

python3 -m pip install -q pip-tools pybuild-deps
pip-compile --output-file=requirements.txt requirements-in.txt
pybuild-deps --generate-hashes --compile --output-file=requirements-build.txt requirements.txt

The failure is:

TypeError: OutputWriter.__init__() got an unexpected keyword argument 'generate_hashes'

Traceback points to pybuild_deps/scripts/compile.py line 124, where it always passes generate_hashes= into a subclass of OutputWriter, regardless of whether --generate-hashes is used.

Looks related to commit 66ac906 (“Remove 'generate_hashes' from OutputWriter”, from @sirosen and @webknjaz ). pip-compile --generate-hashes still works, but downstream tools that subclass OutputWriter and mirror the old constructor API are broken.

My workaround is pinning pip-tools<7.6.1.

Affected: pybuild-deps==0.5.0. I'm just wondering if I should propose a fix on that project (hermetoproject/pybuild-deps#416) or yours, as this may affect other stakeholders.

Also, would it make sense to mention this in the 7.6.1 release notes, or treat the OutputWriter constructor as a public API and deprecate before removing in a future release?

[sirosen]

Hi, thanks for reporting this!

pip-tools has no public API other than the CLI, so I don't think this warrants a changelog and definitely not a deprecation period. The removal was internal cleanup -- an unused attribute which made working on compatibility with the latest pip version the tiniest bit more difficult.

I'm not going to intentionally go out of my way to break people's usage, and it's useful to know that there are things built on top of the package in this way. But I also think this is the reality of building where there is no API guarantee being offered. I may take steps to move more components into piptools._internal to make this clearer for anyone who is not aware of the lack of any stable Python API. That will potentially mean more breakage, but it may help make things less surprising.

[juandspy]

alright, ty! I'll find the way to fix it in pybuild-deps :)

[webknjaz]

@juandspy I also noticed that you're using pip's “API” which doesn't have a public API either. Both are CLI tools. And the CLI is the API. That's it. We're also “breaking the rules” here as we're dipping into pip's internals which broke us requiring this release in the first place and this is a known risk we have to live with. This probably means that once you address your compatibility with pip-tools' signature changes, expect to hit something similar with your pip's imports. Surprise!

---

On a related note, https://pyproject-api.rtfd.io might be of interest to you, especially since PEP 517 deptrees are unlikely to be very big and deep (unless they are...)

You'll probably want to wait for #2124 to be implemented, use that standard for cross-compatibility and rely on subprocess calls as a more robust API.

[juandspy]

:D I'll redirect this to the pybuild-deps owners, thanks! :)