Pipenv update does not update library when GitHub ref in Pipfile is updated

[PaulMest]

First of all, thanks for improving Python packaging. I'm experimenting with Pipenv on some side projects before bringing it into my team's mainline dev workflow.

Brief description

$ pipenv update does not update library when a ref is changed in the Pipfile

Pipfile Snippet 1:

python-binance = {git = "git://github.com/sammchardy/python-binance.git", ref = "e1be0e17921965c1d34e8dbccac522e55fa0f4ac"}

Pipfile Snippet 2:

python-binance = {git = "git://github.com/sammchardy/python-binance.git", ref = "d35b2bb0e1c4cd4d8b9042fc130d82c041fe3c3c"}

---

Expected result

I assumed that by changing the ref in Pipfile to a different commit hash and running $ pipenv update that the old verison of the library would have been removed and the new version would have been installed.

# Expected result:
$ pip list | grep binance 
python-binance        0.6.6

Actual result

The old version stayed in place.

# Actual result:
$ pip list | grep binance 
python-binance        0.6.3

Steps to replicate

# With old Pipfile:
$ pipenv update
...
$ pip list | grep binance 
python-binance        0.6.3

# With new Pipfile:
$ pipenv update
...
$ pip list | grep binance
python-binance        0.6.3

Environment:

Details

Pipenv version: `'11.6.1'`

Pipenv location: '/Users/paul/.pyenv/versions/venv_crypto_tracker/lib/python3.6/site-packages/pipenv'

Python location: '/Users/paul/.pyenv/versions/venv_crypto_tracker/bin/python'

Other Python installations in PATH:

• 2.7: /usr/bin/python2.7

• 2.7: /Users/paul/.pyenv/shims/python2.7

• 2.7: /usr/bin/python2.7

• 3.4: /Users/paul/.pyenv/shims/python3.4

• 3.5: /Users/paul/.pyenv/shims/python3.5

• 3.6: /usr/local/bin/python3.6m

• 3.6: /Users/paul/.pyenv/shims/python3.6

• 3.6: /usr/local/bin/python3.6

• 3.6: /usr/local/bin/python3.6

• 3.6.2: /Users/paul/.pyenv/versions/venv_crypto_tracker/bin/python

• 3.6.2: /Users/paul/.pyenv/shims/python

• 2.7.10: /usr/bin/python

• None: /Users/paul/.pyenv/shims/python2

• 3.6.2: /Users/paul/.pyenv/versions/venv_crypto_tracker/bin/python3

• 3.6.2: /Users/paul/.pyenv/shims/python3

• 3.6.4: /usr/local/bin/python3

• 3.6.4: /usr/local/bin/python3

PEP 508 Information:

{'implementation_name': 'cpython',
 'implementation_version': '3.6.2',
 'os_name': 'posix',
 'platform_machine': 'x86_64',
 'platform_python_implementation': 'CPython',
 'platform_release': '17.4.0',
 'platform_system': 'Darwin',
 'platform_version': 'Darwin Kernel Version 17.4.0: Sun Dec 17 09:19:54 PST '
                     '2017; root:xnu-4570.41.2~1/RELEASE_X86_64',
 'python_full_version': '3.6.2',
 'python_version': '3.6',
 'sys_platform': 'darwin'}

System environment variables:

• PIP_DOWNLOAD_CACHE
• LDFLAGS
• TERM_PROGRAM
• PIP_REQUIRE_VIRTUALENV
• PYENV_ROOT
• SHELL
• TERM
• HISTSIZE
• TMPDIR
• CPPFLAGS
• Apple_PubSub_Socket_Render
• TERM_PROGRAM_VERSION
• TERM_SESSION_ID
• PYENV_VERSION
• USER
• HISTFILESIZE
• REACT_EDITOR
• SSH_AUTH_SOCK
• PYENV_DIR
• __CF_USER_TEXT_ENCODING
• PYENV_VIRTUALENV_INIT
• VIRTUAL_ENV
• PYENV_VIRTUAL_ENV
• PATH
• PWD
• EDITOR
• LANG
• ITERM_PROFILE
• PYENV_HOOK_PATH
• XPC_FLAGS
• _OLD_VIRTUAL_PS1
• ITERM_ORIG_PS1
• RBENV_SHELL
• XPC_SERVICE_NAME
• HISTCONTROL
• COLORFGBG
• HOME
• SHLVL
• PYENV_SHELL
• ITERM_PREV_PS1
• ITERM_SESSION_ID
• LOGNAME
• PKG_CONFIG_PATH
• ARCHFLAGS
• DISPLAY
• COLORTERM
• PIP_PYTHON_PATH
• PYTHONUNBUFFERED

Pipenv–specific environment variables:

Debug–specific environment variables:

• PATH: /Users/paul/.pyenv/versions/venv_crypto_tracker/bin:/usr/local/Cellar/pyenv/1.2.2/libexec:/Users/paul/.npm-global/bin:/usr/local/Cellar/pyenv-virtualenv/1.1.1/shims:/Users/paul/.pyenv/shims:/Users/paul/google-cloud-sdk/bin:/usr/local/heroku/bin:/Users/paul/.rbenv/shims:/usr/local/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/opt/X11/bin:/usr/local/sbin
• SHELL: /bin/bash
• EDITOR: idea
• LANG: en_US.UTF-8
• PWD: /Users/paul/code/CleverPoint/crypto_tracker/django_project
• VIRTUAL_ENV: /Users/paul/.pyenv/versions/3.6.2/envs/venv_crypto_tracker

---

Contents of Pipfile ('/Users/paul/code/CleverPoint/crypto_tracker/django_project/Pipfile'):

[[source]]

url = "https://pypi.python.org/simple"
verify_ssl = true
name = "pypi"


[packages]

Django = "*"
ipython = "*"
"21d210f" = {path = "/Users/paul/code/CleverPoint/GDAX-Python", editable = true}
python-dotenv = "*"
python-bittrex = {git = "git://github.com/ericsomdahl/python-bittrex.git", ref = "fc2d00286b474e8c153b1056eb1d07b44296988e"}
geminipy = {git = "git://github.com/geminipy/geminipy.git", ref = "0d83fe225b746ac4c8bb800aa6091e1b606231e8"}
python-binance = {git = "git://github.com/sammchardy/python-binance.git", ref = "e1be0e17921965c1d34e8dbccac522e55fa0f4ac"}
python-kucoin = {git = "git://github.com/sammchardy/python-kucoin.git", ref = "2a31d333e0c32d815547ba685ba620a3815c4e1d"}
coinbase = {git = "git://github.com/coinbase/coinbase-python.git", ref = "f9ed2249865c2012e3b86106dad5f8c6068366ed"}
poloniex = {git = "git://github.com/s4w3d0ff/python-poloniex.git", ref = "1a00f430cda9ca515c74dd056927060c615e33b7"}
krakenex = {git = "git://github.com/veox/python3-krakenex.git", ref = "46eac501ebe7b20771b7ea08adb37fcfbe34224e"}
python-dateutil = "*"
requests = "*"
django-webpack-loader = "*"
twilio = "*"
dj-database-url = "*"
"psycopg2-binary" = "*"


[dev-packages]



[requires]

python_version = "3.6"

Contents of Pipfile.lock ('/Users/paul/code/CleverPoint/crypto_tracker/django_project/Pipfile.lock'):

{
    "_meta": {
        "hash": {
            "sha256": "0530cc072da6a31d9e2a26b9e1313692b9f1e539cf927be1d7cec088ee662d0e"
        },
        "pipfile-spec": 6,
        "requires": {
            "python_version": "3.6"
        },
        "sources": [
            {
                "name": "pypi",
                "url": "https://pypi.python.org/simple",
                "verify_ssl": true
            }
        ]
    },
    "default": {
        "21d210f": {
            "editable": true,
            "path": "/Users/paul/code/CleverPoint/GDAX-Python"
        },
        "appnope": {
            "hashes": [
                "sha256:5b26757dc6f79a3b7dc9fab95359328d5747fcb2409d331ea66d0272b90ab2a0",
                "sha256:8b995ffe925347a2138d7ac0fe77155e4311a0ea6d6da4f5128fe4b3cbe5ed71"
            ],
            "markers": "sys_platform == 'darwin'",
            "version": "==0.1.0"
        },
        "bintrees": {
            "hashes": [
                "sha256:18f552b1e41d0d2ad0d9e384caebc617ea676359901704ae475c922bd85d7fad",
                "sha256:3270aa3d541906382d823eb4406bf3b9ad5d2731c12c58f22cb2e12475addb90",
                "sha256:4188dcc69397b2513aef1ece1b3ea99e0663c75ed7bee7814f671a462819fd31",
                "sha256:60675e6602cef094abcd38bf4aecc067d78ae2d5e1645615c789724542d11270",
                "sha256:70f1a1621850a614cea3c24bda0d54e63c46dd30243206764e23748a75eedd61",
                "sha256:730ed144319c82edff3b4d151a70aae7371054e1f3bfed4d44db87ccbebe8c7f",
                "sha256:94e604f709151d0e678e06baa269fc748ae48667678ec23eb2b6704d743aa34f"
            ],
            "version": "==2.0.7"
        },
        "certifi": {
            "hashes": [
                "sha256:14131608ad2fd56836d33a71ee60fa1c82bc9d2c8d98b7bdbc631fe1b3cd1296",
                "sha256:edbc3f203427eef571f79a7692bb160a2b0f7ccaa31953e99bd17e307cf63f7d"
            ],
            "version": "==2018.1.18"
        },
        "chardet": {
            "hashes": [
                "sha256:84ab92ed1c4d4f16916e05906b6b75a6c0fb5db821cc65e70cbd64a3e2a5eaae",
                "sha256:fc323ffcaeaed0e0a02bf4d117757b98aed530d9ed4531e3e15460124c106691"
            ],
            "version": "==3.0.4"
        },
        "coinbase": {
            "git": "git://github.com/coinbase/coinbase-python.git",
            "ref": "f9ed2249865c2012e3b86106dad5f8c6068366ed"
        },
        "colorama": {
            "hashes": [
                "sha256:463f8483208e921368c9f306094eb6f725c6ca42b0f97e313cb5d5512459feda",
                "sha256:48eb22f4f8461b1df5734a074b57042430fb06e1d61bd1e11b078c0fe6d7a1f1"
            ],
            "markers": "sys_platform == 'win32'",
            "version": "==0.3.9"
        },
        "decorator": {
            "hashes": [
                "sha256:7d46dd9f3ea1cf5f06ee0e4e1277ae618cf48dfb10ada7c8427cd46c42702a0e",
                "sha256:94d1d8905f5010d74bbbd86c30471255661a14187c45f8d7f3e5aa8540fdb2e5"
            ],
            "version": "==4.2.1"
        },
        "dj-database-url": {
            "hashes": [
                "sha256:4aeaeb1f573c74835b0686a2b46b85990571159ffc21aa57ecd4d1e1cb334163",
                "sha256:851785365761ebe4994a921b433062309eb882fedd318e1b0fcecc607ed02da9"
            ],
            "version": "==0.5.0"
        },
        "django": {
            "hashes": [
                "sha256:3d9916515599f757043c690ae2b5ea28666afa09779636351da505396cbb2f19",
                "sha256:769f212ffd5762f72c764fa648fca3b7f7dd4ec27407198b68e7c4abf4609fd0"
            ],
            "version": "==2.0.3"
        },
        "django-webpack-loader": {
            "hashes": [
                "sha256:60bab6b9a037a5346fad12d2a70a6bc046afb33154cf75ed640b93d3ebd5f520",
                "sha256:970b968c2a8975fb7eff56a3bab5d0d90d396740852d1e0c50c5cfe2b824199a"
            ],
            "version": "==0.6.0"
        },
        "enum34": {
            "hashes": [
                "sha256:2d81cbbe0e73112bdfe6ef8576f2238f2ba27dd0d55752a776c41d38b7da2850",
                "sha256:644837f692e5f550741432dd3f223bbb9852018674981b1664e5dc339387588a",
                "sha256:6bd0f6ad48ec2aa117d3d141940d484deccda84d4fcd884f5c3d93c23ecd8c79",
                "sha256:8ad8c4783bf61ded74527bffb48ed9b54166685e4230386a9ed9b1279e2df5b1"
            ],
            "markers": "python_version == '3.3'",
            "version": "==1.1.6"
        },
        "gdax": {
            "editable": true,
            "git": "git@github.com:PaulMest/GDAX-Python.git",
            "ref": "ad6936ebe4a97315f1a45330eb9b531dd1454287"
        },
        "geminipy": {
            "git": "git://github.com/geminipy/geminipy.git",
            "ref": "0d83fe225b746ac4c8bb800aa6091e1b606231e8"
        },
        "idna": {
            "hashes": [
                "sha256:2c6a5de3089009e3da7c5dde64a141dbc8551d5b7f6cf4ed7c2568d0cc520a8f",
                "sha256:8c7309c718f94b3a625cb648ace320157ad16ff131ae0af362c9f21b80ef6ec4"
            ],
            "version": "==2.6"
        },
        "ipython": {
            "hashes": [
                "sha256:51c158a6c8b899898d1c91c6b51a34110196815cc905f9be0fa5878e19355608",
                "sha256:fcc6d46f08c3c4de7b15ae1c426e15be1b7932bcda9d83ce1a4304e8c1129df3"
            ],
            "version": "==6.2.1"
        },
        "ipython-genutils": {
            "hashes": [
                "sha256:72dd37233799e619666c9f639a9da83c34013a73e8bbc79a7a6348d93c61fab8",
                "sha256:eb2e116e75ecef9d4d228fdc66af54269afa26ab4463042e33785b887c628ba8"
            ],
            "version": "==0.2.0"
        },
        "jedi": {
            "hashes": [
                "sha256:d6e799d04d1ade9459ed0f20de47c32f2285438956a677d083d3c98def59fa97",
                "sha256:d795f2c2e659f5ea39a839e5230d70a0b045d0daee7ca2403568d8f348d0ad89"
            ],
            "version": "==0.11.1"
        },
        "krakenex": {
            "git": "git://github.com/veox/python3-krakenex.git",
            "ref": "46eac501ebe7b20771b7ea08adb37fcfbe34224e"
        },
        "parso": {
            "hashes": [
                "sha256:5815f3fe254e5665f3c5d6f54f086c2502035cb631a91341591b5a564203cffb",
                "sha256:a7bb86fe0844304869d1c08e8bd0e52be931228483025c422917411ab82d628a"
            ],
            "version": "==0.1.1"
        },
        "pathlib2": {
            "hashes": [
                "sha256:d32550b75a818b289bd4c1f96b60c89957811da205afcceab75bc8b4857ea5b3",
                "sha256:db3e43032d23787d3e9aec8c7ef1e0d2c3c589d5f303477661ebda2ca6d4bfba"
            ],
            "markers": "python_version == '3.3'",
            "version": "==2.3.0"
        },
        "pexpect": {
            "hashes": [
                "sha256:67b85a1565968e3d5b5e7c9283caddc90c3947a2625bed1905be27bd5a03e47d",
                "sha256:6ff881b07aff0cb8ec02055670443f784434395f90c3285d2ae470f921ade52a"
            ],
            "markers": "sys_platform != 'win32'",
            "version": "==4.4.0"
        },
        "pickleshare": {
            "hashes": [
                "sha256:84a9257227dfdd6fe1b4be1319096c20eb85ff1e82c7932f36efccfe1b09737b",
                "sha256:c9a2541f25aeabc070f12f452e1f2a8eae2abd51e1cd19e8430402bdf4c1d8b5"
            ],
            "version": "==0.7.4"
        },
        "poloniex": {
            "git": "git://github.com/s4w3d0ff/python-poloniex.git",
            "ref": "1a00f430cda9ca515c74dd056927060c615e33b7"
        },
        "prompt-toolkit": {
            "hashes": [
                "sha256:1df952620eccb399c53ebb359cc7d9a8d3a9538cb34c5a1344bdbeb29fbcc381",
                "sha256:3f473ae040ddaa52b52f97f6b4a493cfa9f5920c255a12dc56a7d34397a398a4",
                "sha256:858588f1983ca497f1cf4ffde01d978a3ea02b01c8a26a8bbc5cd2e66d816917"
            ],
            "version": "==1.0.15"
        },
        "psycopg2-binary": {
            "hashes": [
                "sha256:02eb674e3d5810e19b4d5d00720b17130e182da1ba259dda608aaf33d787347d",
                "sha256:3a14baeabcebd4662f12f4bff03e0574a2369a2e41baf829e6fb4a24c95cf88b",
                "sha256:436a503eda41f6adb08f292f40a3784fce0a5f351b6ae7b19a911904db53af93",
                "sha256:465ff1d427ed42c31e456dbbd9edab3552be18a0edaef7450c5b3e6fee745052",
                "sha256:4a1a5ea2fa4b53191637b162873a82822d92a85a08beefe28296b8eb5cf2fea5",
                "sha256:4a4f23a08fbccbe40ecdb5384d807bcb469ea71dd87e6be2e80b036b8e6d47df",
                "sha256:77a2fc622a1f2d08a707673c9be5769d521f03d867d305f172bb417fa7882754",
                "sha256:8014c06a9ed7b78ba81beff3ae71acd78c212390f8ed839e9ce22735880bd5b4",
                "sha256:83af04029bcb4b56c852e5876fef71340dcb465fa44fc99f80bac72e10fb0b74",
                "sha256:86c0d2587f56776f25d52cca8e275adf495c8e01933fbfc2ca23b124610ab761",
                "sha256:9305d7cbc802aaefac5c75a3df725f2654797369f32b18d4d0adb382dfab6c09",
                "sha256:9b5ddbed85ec73293695d7116589d956ef0dd3fcf7bf3b2a3bc1e8e54c1d543a",
                "sha256:a3d2cc0cb0b988dbfd0d11f7fac34058b25a6ce533ed5b8e88d6cb315e77d54a",
                "sha256:ab1db8f3e96570d9f7ebc45133ce2574804b2280499baade178e163d022107b5",
                "sha256:b039f51bca1ddd70234cc3f84f94f42ad43861b931bdfb497f887c60c39a6565",
                "sha256:b287ddf4cafcfb632974907d1e7862119e36bb758228bdb07dd247553e4cdfc0",
                "sha256:b6b2b26590304d97ef2af28d153ee99ace6fe0806934f4618edfc87216c77f91",
                "sha256:c4c6004d410c77bfa5389ae9485498ce32805447a67afbfe8db0d247a5c88fa1",
                "sha256:c606bff0978ee4858d86d40f6b6ab0c4cac4474f627bd054683dc03a4fc1a366",
                "sha256:c8220c521a408b41c4f14036004a621ed0d965941286b978cd2ea2623fabd755",
                "sha256:cb07184a4bfad304831f0a88b1c13fbd8cf9fcdf1f11e71c477dd6d7b1b078a0",
                "sha256:cf3911fba0c47fc1313b5783183cda301032b14637a0b7a336766ae46998c7ee",
                "sha256:d0972f062c73956332e9681dfdb133168618f0abfecc96e89f0205ac89cd454b",
                "sha256:d1dd3eb8edd354083f5d27b968c5a17854c41347ba5a480b520be85ec1a8495c",
                "sha256:d51c7ed810fce1e50464088c37cc8da05534de8afb12a732500827ebcc480081",
                "sha256:d8940b5104588d6313315e037f0f5ed68d2e5f62ccc1c429d3cff11d2ba6de3f",
                "sha256:de4f88f823037a71ea5ef3c1041d96b8a68d73343133edda684fd42f575bd9d7"
            ],
            "version": "==2.7.4"
        },
        "ptyprocess": {
            "hashes": [
                "sha256:e64193f0047ad603b71f202332ab5527c5e52aa7c8b609704fc28c0dc20c4365",
                "sha256:e8c43b5eee76b2083a9badde89fd1bbce6c8942d1045146e100b7b5e014f4f1a"
            ],
            "version": "==0.5.2"
        },
        "pygments": {
            "hashes": [
                "sha256:78f3f434bcc5d6ee09020f92ba487f95ba50f1e3ef83ae96b9d5ffa1bab25c5d",
                "sha256:dbae1046def0efb574852fab9e90209b23f556367b5a320c0bcb871c77c3e8cc"
            ],
            "version": "==2.2.0"
        },
        "pyjwt": {
            "hashes": [
                "sha256:9c3016e4a292151c5396e25cc0c28c4e1cdf13fa19118eb84f500f9670e3f628",
                "sha256:b752500cafd4df9f0dc6efe9063603e36a4e1a5c24fee48234d2949b6606aa59"
            ],
            "version": "==1.6.0"
        },
        "pysocks": {
            "hashes": [
                "sha256:3fe52c55890a248676fd69dc9e3c4e811718b777834bcaab7a8125cf9deac672"
            ],
            "markers": "python_version >= '3.0'",
            "version": "==1.6.8"
        },
        "python-binance": {
            "git": "git://github.com/sammchardy/python-binance.git",
            "ref": "d35b2bb0e1c4cd4d8b9042fc130d82c041fe3c3c"
        },
        "python-bittrex": {
            "git": "git://github.com/ericsomdahl/python-bittrex.git",
            "ref": "fc2d00286b474e8c153b1056eb1d07b44296988e"
        },
        "python-dateutil": {
            "hashes": [
                "sha256:07009062406cffd554a9b4135cd2ff167c9bf6b7aac61fe946c93e69fad1bbd8",
                "sha256:8f95bb7e6edbb2456a51a1fb58c8dca942024b4f5844cae62c90aa88afe6e300"
            ],
            "version": "==2.7.0"
        },
        "python-dotenv": {
            "hashes": [
                "sha256:4965ed170bf51c347a89820e8050655e9c25db3837db6602e906b6d850fad85c",
                "sha256:509736185257111613009974e666568a1b031b028b61b500ef1ab4ee780089d5"
            ],
            "version": "==0.8.2"
        },
        "python-kucoin": {
            "git": "git://github.com/sammchardy/python-kucoin.git",
            "ref": "2a31d333e0c32d815547ba685ba620a3815c4e1d"
        },
        "pytz": {
            "hashes": [
                "sha256:07edfc3d4d2705a20a6e99d97f0c4b61c800b8232dc1c04d87e8554f130148dd",
                "sha256:3a47ff71597f821cd84a162e71593004286e5be07a340fd462f0d33a760782b5",
                "sha256:410bcd1d6409026fbaa65d9ed33bf6dd8b1e94a499e32168acfc7b332e4095c0",
                "sha256:5bd55c744e6feaa4d599a6cbd8228b4f8f9ba96de2c38d56f08e534b3c9edf0d",
                "sha256:61242a9abc626379574a166dc0e96a66cd7c3b27fc10868003fa210be4bff1c9",
                "sha256:887ab5e5b32e4d0c86efddd3d055c1f363cbaa583beb8da5e22d2fa2f64d51ef",
                "sha256:ba18e6a243b3625513d85239b3e49055a2f0318466e0b8a92b8fb8ca7ccdf55f",
                "sha256:ed6509d9af298b7995d69a440e2822288f2eca1681b8cce37673dbb10091e5fe",
                "sha256:f93ddcdd6342f94cea379c73cddb5724e0d6d0a1c91c9bdef364dc0368ba4fda"
            ],
            "version": "==2018.3"
        },
        "requests": {
            "hashes": [
                "sha256:6a1b267aa90cac58ac3a765d067950e7dbbf75b1da07e895d1f594193a40a38b",
                "sha256:9c443e7324ba5b85070c4a818ade28bfabedf16ea10206da1132edaa6dda237e"
            ],
            "markers": "python_version >= '3.0'",
            "version": "==2.18.4"
        },
        "simplegeneric": {
            "hashes": [
                "sha256:dc972e06094b9af5b855b3df4a646395e43d1c9d0d39ed345b7393560d0b9173"
            ],
            "version": "==0.8.1"
        },
        "six": {
            "hashes": [
                "sha256:70e8a77beed4562e7f14fe23a786b54f6296e34344c23bc42f07b15018ff98e9",
                "sha256:832dc0e10feb1aa2c68dcc57dbb658f1c7e65b9b61af69048abc87a2db00a0eb"
            ],
            "version": "==1.11.0"
        },
        "traitlets": {
            "hashes": [
                "sha256:9c4bd2d267b7153df9152698efb1050a5d84982d3384a37b2c1f7723ba3e7835",
                "sha256:c6cb5e6f57c5a9bdaa40fa71ce7b4af30298fbab9ece9815b5d995ab6217c7d9"
            ],
            "version": "==4.3.2"
        },
        "twilio": {
            "hashes": [
                "sha256:4e7eb831b56f4828d5413856d52222770c1edaa4abb38a9f8d42394ef6ad6da6",
                "sha256:6defbba8a10e45ac5c2ee1797ae3f0ed5df64231ad7d92a41ba952b563925a5d"
            ],
            "version": "==6.10.5"
        },
        "typing": {
            "hashes": [
                "sha256:3a887b021a77b292e151afb75323dea88a7bc1b3dfa92176cff8e44c8b68bddf",
                "sha256:b2c689d54e1144bbcfd191b0832980a21c2dbcf7b5ff7a66248a60c90e951eb8",
                "sha256:d400a9344254803a2368533e4533a4200d21eb7b6b729c173bc38201a74db3f2"
            ],
            "markers": "python_version <= '3.4'",
            "version": "==3.6.4"
        },
        "urllib3": {
            "hashes": [
                "sha256:06330f386d6e4b195fbfc736b297f58c5a892e4440e54d294d7004e3a9bbea1b",
                "sha256:cc44da8e1145637334317feebd728bd869a35285b93cbb4cca2577da7e62db4f"
            ],
            "version": "==1.22"
        },
        "wcwidth": {
            "hashes": [
                "sha256:3df37372226d6e63e1b1e1eda15c594bca98a22d33a23832a90998faa96bc65e",
                "sha256:f4ebe71925af7b40a864553f761ed559b43544f8f71746c2d756c7fe788ade7c"
            ],
            "version": "==0.1.7"
        },
        "websocket-client": {
            "hashes": [
                "sha256:188b68b14fdb2d8eb1a111f21b9ffd2dbf1dbc4e4c1d28cf2c37cdbf1dd1cae6",
                "sha256:a453dc4dfa6e0db3d8fd7738a308a88effe6240c59f3226eb93e8f020c216149"
            ],
            "version": "==0.47.0"
        },
        "win-unicode-console": {
            "hashes": [
                "sha256:d4142d4d56d46f449d6f00536a73625a871cba040f0bc1a2e305a04578f07d1e"
            ],
            "markers": "sys_platform == 'win32' and python_version < '3.6'",
            "version": "==0.5"
        }
    },
    "develop": {}
}

[kennethreitz]

Thanks for the report!

[kennethreitz]

I think ref is intended to only work in the lockfile, not in the pipfile.

[PaulMest]

My goal is to pin my installed libraries to specific git commit hashes.

With pip, I would update requirements.txt by changing the commit hash and running $ pip install -Ur requirements.txt. It would remove the previously pinned commit hash and install the new commit hash.

What's the suggested workflow for Pipenv? Or is this not a supported scenario?

[Diggsey]

Yeah this is quite irritating - the best workaround I've found is to have the person updating the ref to manually install the new version via pip install before running pipenv lock - the lock file will then be generated correctly, and once the updated ref is in the lock file then pipenv will work as expected for everyone else working on the code.

[techalchemy]

Yeah I find it irritating myself. I know how to handle it even, just haven’t had a chance. Had this issue sitting open in a tab in my browser for weeks.