"pipenv uninstall --keep-outdated <package>" does not remove the removed package information in Pipfile.lock

[y-ich]

Be sure to check the existing issues (both open and closed!), and make sure you are running the latest version of Pipenv.

Check the diagnose documentation for common issues before posting! We may close your issue if it is very similar to one of them. Please be considerate, or be on your way.

Make sure to mention your debugging experience if the documented solution failed.

Issue description

"pipenv uninstall --keep-outdated " does not remove the removed package information in Pipfile.lock.

I often replace a package to the local one for debugging. In order to keep other dependencies, "--keep-outdated" is preferable as below.

 pipenv uninstall --keep-outdated <package>
 pipenv install --keep-outdated -e <local directory of package>

But actually these instructions fail to install since Pipfile.lock keeps the package information by pipenv uninstall --keep-outdated <package> and pipenv install --keep-outdated -e <local directory of package> installs <package> instead of <local directory of package>.

Expected result

"pipenv uninstall --keep-outdated " removes the removed package information in Pipfile.lock.

Actual result

When possible, provide the verbose output (--verbose), especially for locking and dependencies resolving issues.

Steps to replicate

pipenv install urllib3
pipenv uninstall --keep-outdated urllib3

---

Please run $ pipenv --support, and paste the results here. Don't put backticks (`) around it! The output already contains Markdown formatting.

I tried to paste it but hesitated it because it exposes many private environmental variables. Please improve this instruction.

[rjafarau]

The same issue! v2020.11.15

[jkogler-cloudflight]

Same issue here: v2021.05.29

[tisdall]

I was trying to use this to remove a package without touching anything else. It seems like uninstall --keep-outdated does remove the installed package from the virtualenv and also removes it from Pipfile. However, because it's still in Pipfile.lock then pipenv install will just reinstall it again.

% pipenv --version          
pipenv, version 2021.11.15

As a workaround, I found I could manually just remove the entries in Pipfile.lock and everything seems to work. However the sha256 hash in the _meta makes me think I shouldn't be doing this.

[jkogler-cloudflight]

@tisdall The _meta hash is only computed with the data in the Pipfile. So if you manually change something in the Pipfile.lock, it will not change. So everything good.

[matteius]

Verified on master.

[matteius]

-keep-outdated has been deprecated for removal in the main branch, the warning will be included in the next release. The reason why is a fundamental design flaw that -keep-outdated tries to merge the results of the old resolver result with any new packages from a new resolver result which often creates more problems than it solves. Guidance is to set appropriate specifiers in your Pipfile so as all of the categories get resolved to your liking. There is really no way to improve -keep-outdated implementation without pipenv writing its own resolver, but that is not in the plan as there are many benefits to continuing to utilize the pip resolver.