component-detection
component-detection copied to clipboard
Python: Handle multiple dependency specifiers for the same package
In PythonResolver
and SimplePythonResolver
, as surfaced in #962 there is the potential for multiple package version specifications for the same package present in a .WHL file returned by pypi. PythonResolver
and SimplePythonResolver
will now resolve this mismatch by choosing the latest entry, but this logic may result in lost versions.
Investigate pypi responses and documentation to see if there is a better method of handling this case.
Example: https://pypi.org/project/msal-extensions/ https://files.pythonhosted.org/packages/52/34/a8995d6f0fa626ff6b28dbd9c90f6c2a46bd484bc7ab343d078b0c6ff1a7/msal_extensions-1.0.0-py2.py3-none-any.whl
AB#2139080
Relevant function: ResolveDependencySpecifications
in PythonResolverBase
@cobya can you please share ETA for this fix ?
@hravellamicrosoft we do not have a current ETA for this. The fixes in #962 will be rolled out in the next release of our internal tooling but this repo's discussions should be kept separate from that.