Potential dependency conflicts between quickstartup and django

[NeolithEra]

Hi, as shown in the following full dependency graph of quickstartup, quickstartup requires django >=3.0,<3.1, quickstartup requires django-widget-tweaks >=1.4,<1.5 (django-widget-tweaks 1.4.8 will be installed, i.e., the newest version satisfying the version constraint), and directed dependency django-widget-tweaks 1.4.8 transitively introduces django >=1.11.

Obviously, there are multiple version constraints set for django in this project. However, according to pip's “first found wins” installation strategy, django 3.0.6 (i.e., the newest version satisfying constraint >=3.0,<3.1) is the actually installed version.

Although the first found package version django 3.0.6 just satisfies the later dependency constraint （django >=3.0,<3.1), such installed version is very close to the upper bound of the version constraint of django specified by django-widget-tweaks 1.4.8.

Once django-widget-tweaks upgrades，its newest version will be installed, as quickstartup does not specify the upper bound of version constraint for django-widget-tweaks. Therefore, it will easily cause a dependency conflict (build failure), if the upgraded django-widget-tweaks version introduces a higher version of django, violating its another version constraint >=3.0,<3.1.

According to the release history of django-widget-tweaks, it habitually upgrates Django in its recent releases. For instance, django-widget-tweaks 1.4.2 upgrated Django’s constraint from >=1.2 to >=1.8, and django-widget-tweaks 1.4.6 upgrated Django’s constraint from >=1.8 to >=1.11.

As such, it is a warm warning of a potential dependency conflict issue for quickstartup.

Dependency tree

quickstartup - 0.16.2
| +- django(install version:3.0.6 version range:>=3.0,<3.1)
| +- django-ipware(install version:2.1.0 version range:>=2.1,<2.2)
| +- django-model-utils(install version:4.0.0 version range:>=4.0,<4.1)
| | +- django(install version:3.0.6 version range:>=2.0.1)
| +- django-widget-tweaks(install version:1.4.8 version range:>=1.4,<1.5)
| | +- django(install version:3.0.6 version range:>=1.11)
| +- djmail(install version:2.0.0 version range:>=2.0,<2.1)

Thanks for your help.
Best,
Neolith

[NeolithEra]

Suggested Solution

1. Loosen the version range of django to be >=3.0.
2. Remove your direct dependency django, and use the django transitively introduced by django-widget-tweaks.
3. Change your direct dependency django-widget-tweaks to be >=1.4,<=1.4.8.
   @osantana Which solution do you prefer, 1 ,2or 3?
   Please let me know your choice. May I pull a request to solve this issue?

[osantana]

To be honest, I don't see any problem with the current configuration, and I will explain why:

I think that the "right way" to manage dependency versions relies on the purpose of each component. If your component is a "library" (like quickstartup), you need to specify your requirements in a lousy way just to make sure that changes on the requirements won't break your component. That's why I keep the same minor version in ranges: theoretically, micro changes won't break the API. So, if django-widget-tweaks requires a version of Django that quickstartup does not support. I can't use it on quickstartup unless I check if it don't break anything. The other thing that we need to do is to declare only the exact requirements that you use in your library.

On other hand, if your software is a Project/App it's desirable that you "pin" your requirements down to the exact version that you are using including the requirements of your requirements. So, it's a good idea to "pin" the versions of Django, quickstartup and django-widget-tweaks on your project (obviously respecting the "ranges" of all dependencies).