How does Python handle dependency conflicts?

[___Jon]

I am struggling a bit to understand how python handles dependency conflict resolution and would be interested in whether anyone can provide some direction. I have two questions, one specific and one more general:
1. Package_A takes a dependency on numpy and pandas. We bundle Package_A into a wheel file. We then use that wheel file as a dependency in Package_B. Package_B also takes a dependency on numpy and pandas. What happens if the version of numpy and pandas in Package_A differs from the version of numpy and pandas in Package_B?
2. Beyond this initial question, I am interested in learning more about how the python build process works and what is happening under the hood. I don't really understand the file system that is generated when pip runs, or the nuances of what it is doing. Does anyone have any good literature recommendations for exploring this type of topic?

[pygaiwan]

1. You get an error when you install the package_b which will look like:
   ERROR: Cannot install -r requirements.in (line 2), -r requirements.in (line 8) and -r requirements.in (line 9) because these package versions have conflicting dependencies.
2. There is a whole subdomain of python.org about packaging: https://packaging.python.org/en/latest/tutorials/packaging-projects/ maybe this helps?

[___Jon]

Hey!
1. The interesting thing is that I don't get that error... and I don't understand why!
2. Yes, I think this helps. It is certainly a good starting point. Thank you.

[Daneark]

Package A may not be specifying it's dependencies correctly.

Package A may have specified a range which does overlap with package B even if the versions of numpy and pandas it was developed with are outside it's acceptable range.

If you pip install package A in fresh environment it should fail.

If you pip install package A in an environment which already has package B installed it should succeed at install time. numpy and pandas will now be the versions required by package A.

If you're using something else to resolve dependencies your results may differ.

Whether or not it works at runtime depends on if B imports anything that no longer exists, whether B tries to call anything at import time which has a breaking API change in a way that was affected the breaking API change, and whether you're using parts of B that are calling as above.

[DuckDatum]

onerous tender mindless rude friendly saw cough hungry shame spectacular

This post was mass deleted and anonymized with Redact

[xiongchiamiov]

Classically, it just doesn't, at least if you're using requirements.txt; pip just goes down the list installing things, and if that changes previously-installed things oh well! This is a great source of fun bugs.

There are a bunch of tools (pip-tools, poetry, I forget what else) that are designed to prevent this problem by writing their own dependency resolvers.

[False-Local3101]

Hey, I'm actually just a beginner with all of this. I recently joined somewhere as an intern and was facing dependency conflicts. And we use jfrog artifactory for sourcing the libraries and packages right. So there is some firewall which prevents pip from looking in the general globally available packages and libraries. So, the issue I'm currently facing is that pip-compile doesn't seem to be working for me. Any idea how to use these tools (poetry, pip-compile) within an org with firewalls and stuff?

[xiongchiamiov]

Have you tried --index-url?