python-social-auth/social-core

Requirement causing install of release candidates for dependency Defusedxml

bj00rn opened this issue · 0 comments

Expected behaviour

Installing social-auth-core should install latest stable release of defusedxml.

Actual behaviour

defusedxml-0.8.0rc2 is installed instead of latest version defusedxml-0.7.1

What are the steps to reproduce this issue?

  1. Install social-auth-core
$ pip install social-auth-core
  1. Check output
Successfully installed defusedxml-0.8.0rc2 python3-openid-3.2.0 social-auth-core-4.5.4

Any logs, error output, etc?

$ pip index versions defusedxml
WARNING: pip index is currently an experimental command. It may be removed/changed in a future release without prior warning.
defusedxml (0.7.1)
Available versions: 0.7.1, 0.7.0, 0.6.0, 0.5.0, 0.4.1, 0.4
  INSTALLED: 0.8.0rc2
  LATEST:    0.7.1
$ pip install social-auth-core
Downloading social_auth_core-4.5.4-py3-none-any.whl (410 kB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 410.2/410.2 kB 4.9 MB/s eta 0:00:00
Using cached defusedxml-0.8.0rc2-py2.py3-none-any.whl (25 kB)
Downloading python3_openid-3.2.0-py3-none-any.whl (133 kB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 133.7/133.7 kB 2.4 MB/s eta 0:00:00
Installing collected packages: defusedxml, python3-openid, social-auth-core
Successfully installed defusedxml-0.8.0rc2 python3-openid-3.2.0 social-auth-core-4.5.4

Add any code, log or error output that you see fit for this issue, wrap any code
and / or console output with the proper code blocks.

Any other comments?

Since a minimal release candidate version is specifed in dependencies pip resolves this dependency to accept pre-releases.

https://github.com/python-social-auth/social-core/blob/4384f382e7d60b07dc26868045cbdf19866248ec/requirements-base.txt#L6C1-L6C11