importlib-metadata pinned at v4.3 creates unresolvable dependency resolution

[nicksellen]

Please describe how you installed Flake8

$ git clone https://github.com/karrot-dev/karrot-backend
$ cd karrot-backend
$ ./sync.py
# that runs pip-sync and ultimately installs flake8==4.0.1 from requirements.txt

Please provide the exact, unmodified output of flake8 --bug-report

Can't install because of problem, so cannot run that.

Please describe the problem or feature

When trying to upgrade our dependencies, using pip-tools, we run

pip-compile --upgrade --no-annotate

This fails with:

Could not find a version that matches importlib-metadata<4.3,>=1.0,>=4.4 (from -r requirements.in (line 73))
Tried: 0.0, 0.1, 0.1, 0.2, 0.2, 0.3, 0.3, 0.4, 0.4, 0.5, 0.5, 0.6, 0.6, 0.7, 0.7, 0.8, 0.8, 0.9, 0.9, 0.10, 0.10, 0.11, 0.11, 0.12, 0.12, 0.13, 0.13, 0.14, 0.14, 0.15, 0.15, 0.16, 0.16, 0.17, 0.17, 0.18, 0.18, 0.19, 0.19, 0.20, 0.20, 0.21, 0.21, 0.22, 0.22, 0.23, 0.23, 1.0.0, 1.0.0, 1.1.0, 1.1.0, 1.1.1, 1.1.1, 1.1.2, 1.1.2, 1.1.3, 1.1.3, 1.2.0, 1.2.0, 1.3.0, 1.3.0, 1.4.0, 1.4.0, 1.5.0, 1.5.0, 1.5.1, 1.5.1, 1.5.2, 1.5.2, 1.6.0, 1.6.0, 1.6.1, 1.6.1, 1.7.0, 1.7.0, 2.0.0, 2.0.0, 2.1.0, 2.1.0, 2.1.1, 2.1.1, 2.1.2, 2.1.2, 3.0.0, 3.0.0, 3.1.0, 3.1.0, 3.1.1, 3.1.1, 3.2.0, 3.2.0, 3.3.0, 3.3.0, 3.4.0, 3.4.0, 3.5.0, 3.5.0, 3.6.0, 3.6.0, 3.7.0, 3.7.0, 3.7.1, 3.7.1, 3.7.2, 3.7.2, 3.7.3, 3.7.3, 3.8.0, 3.8.0, 3.8.1, 3.8.1, 3.8.2, 3.8.2, 3.9.0, 3.9.0, 3.9.1, 3.9.1, 3.10.0, 3.10.0, 3.10.1, 3.10.1, 4.0.0, 4.0.0, 4.0.1, 4.0.1, 4.1.0, 4.1.0, 4.2.0, 4.2.0, 4.3.0, 4.3.0, 4.3.1, 4.3.1, 4.4.0, 4.4.0, 4.5.0, 4.5.0, 4.6.0, 4.6.0, 4.6.1, 4.6.1, 4.6.2, 4.6.2, 4.6.3, 4.6.3, 4.6.4, 4.6.4, 4.7.0, 4.7.0, 4.7.1, 4.7.1, 4.8.0, 4.8.0, 4.8.1, 4.8.1, 4.8.2, 4.8.2, 4.8.3, 4.8.3, 4.9.0, 4.9.0, 4.10.0, 4.10.0
There are incompatible versions in the resolved dependencies:
  importlib-metadata (from -r requirements.in (line 73))
  importlib-metadata>=4.4 (from markdown==3.3.6->-r requirements.in (line 19))
  importlib-metadata (from pre-commit==2.16.0->-r requirements.in (line 74))
  importlib-metadata (from click==8.0.3->-r requirements.in (line 50))
  importlib-metadata>=1.0 (from redis==4.1.0->-r requirements.in (line 21))
  importlib-metadata<4.3 (from flake8==4.0.1->-r requirements.in (line 61))

Exited with code exit status 2

It's basically this issue #1474 - which was closed saying:

In the future, please search closed and open issues before creating new ones that are duplicates. And please don't avoid the issue template in the future when opening issues

But I looked (hence finding that issue), but didn't find a duplicate of that...

I can see that importlib-metadata is pinned at 4.3, but does it need to be?

Thanks!

[MarcoGorelli]

I think they meant to suggest that you also search the PRs - #1438

[nicksellen]

Ah yeah, actually just came to that point myself. I see it's a complex issue, although seems sad this PR wasn't accepted #1011 (comment). It's a bit involved for me to really understand all the details.

... and looks like I can't just downgrade markdown either (as the version that introduces the importlib-metadata>=4.4 requirement is the one that adds python 3.10 support (which I use for local dev)).

:/

[sigmavirus24]

If you search for importlib you'll find all the related issues and PRs, not just #1438: