Does pip-tools and/or new resolver prevent upgrading to a subdependency version that breaks a primary dependency?

Question

I am using pip-tools 5.4.0, pip 20.3.1, and python3. I have looked at pip-tools source code and the pip blog post about the new resolver. I do not see an explicit answer to my question. If I run:

pipdeptree
flake8==3.8.4
  - mccabe [required: >=0.6.0,<0.7.0, installed: 0.6.1]
  - pycodestyle [required: >=2.6.0a1,<2.7.0, installed: 2.6.0]
  - pyflakes [required: >=2.2.0,<2.3.0, installed: 2.2.0
...

If I run pip-compile --upgrade, are there internal constraints in pip-tools or dependency-checking in the new pip resolver that will prevent subdependencies from upgrading beyond their constraints, e.g., mccabe upgrading to 0.7.0?

Answer 1

Original pip-tools author here (although today's maintenance is now happening by the JazzBand collective)

Yes, all top-level constraints (the constraints you put in your requirements.in file yourself), as well as any secondary constraints (the constraints required by each concrete package version that gets subsequently resolved) all form one big "constraint space". pip-tools' resolver will always resolve versions within that constraint space, or throw an error.

In your example, the version of mccabe that flake8==3.8.4 requires will thus be respected and as a result the version of mccabe that gets resolved will never be 0.7 or higher. (That's the very purpose of pip-tools.)

At the time of writing this post, 3.8.4 is flake8's highest version. If, however, you specified flake8 (without any version constraints) in your requirements.in file, then it may get upgraded to, say, 3.9.0 in the future. That future version may specify a wider range for mccabe, like mccabe>=0.6,<0.8 or something. In that case, the result of pip-compile --upgrade may upgrade mccabe to 0.7.0 of course.

Answer 2

To the best of my knowledge (which is several years of using pip-tools), pip-tools will always give you a stable tree so long as you do then install dependencies only from the "locked" requirements file.