3 ms·
Poetry (and now pip with its new resolver) has taken a hard line on not letting you install conflicting dependencies(1)(2). On the surface this sounds ideal: yo
by macNchz 6y ago
Poetry (and now pip with its new resolver) has taken a hard line on not letting you install conflicting dependencies(1)(2). On the surface this sounds ideal: you can't wind up with some combination of packages that won't work together.
The reality is that there are tons of Python libraries out there with poorly specified (or just slightly out of date) dependencies, and it's super annoying to have your package manager just give up and say "sorry, not installing that!" when you encounter them. This is an issue when working on applications with lots of dependencies, where I know certain packages will work together despite their setup.py files claiming otherwise.
There are many reasons you'd want to install a version of a library that disagrees with one of your other dependencies...security updates in subdependencies, maintainers who are slow to test against new versions or don't even use their own libraries anymore etc. The answer in these cases shouldn't be limited to "work with the package maintainer to get the dependencies changed, or fork it". Yarn, for example, has a simple way to handle this situation (and a clear understanding of why it's necessary baked into the docs!) (3)
[1] https://github.com/python-poetry/poetry/issues/697 https://github.com/python-poetry/poetry/issues/697
[2] https://github.com/pypa/pip/issues/8076 https://github.com/pypa/pip/issues/8076
[3] https://classic.yarnpkg.com/en/docs/selective-version-resolutions/#toc-why-would-you-want-to-do-this https://classic.yarnpkg.com/en/docs/selective-version-resolu...
- rendaw 6y agoThey also don't let you blacklist bad dependencies or force certain versions of transitive dependencies. Poetry is much better than Pipenv and... text files with lists of packages to install. I introduced it at my workplace because of that, but I'm terrified that we'll at some point need some poorly maintained 3rd party dep and end up with a hack that was worse than anything we had before (like, a poetry wrapper that modifies the lock file after every operation).