Pip does not update too-old dependencies when installing multiple packages

[Zac-HD]

Description
I'll discuss specific packages, since this has been observed in the wild (HypothesisWorks/hypothesis#2113): we recently updated our install_requires dependency on attrs>=16.0 to attrs>=19.2, on the basis that installing the latest version of Hypothesis would update users' attrs too.

• pip install hypothesis does indeed work.
• pip install pytest hypothesis works iff an older version of attrs is not already installed.

It looks like, when multiple packages are listed in an install command, the compatibility of already-installed dependencies are only evaluated for the first package listed and for later packages the presence but not version of dependencies is checked. This also affects the use of requirements files.

Expected behavior

Regardless of other packages listed to install or already present, pip install hypothesis should either result in a compatible set of packages installed or an error message - not a broken environment.

How to Reproduce

[tox]
skipsdist=True
[testenv]
deps =
    pip
    attrs==19.1.0
commands =
    ## Execute the problematic install command
    # pip install hypothesis  # works
    # pip install hypothesis pytest  # works
    pip install pytest hypothesis  #  fails, as does `pip install attrs hypothesis` !
    # pip install --upgrade pytest hypothesis  # works

    ## Check that the installed packages are compatible
    python -c "import hypothesis"

Then run tox --recreate to, well, recreate the virtual environment and run the commands.

(And thanks to everyone working on pip, it's very valuable and much appreciated 😍)

[pradyunsg]

Thanks for details and easy reproducer! Much appreciated!

This is basically #988. As a quick summary:

• pip does print a message in red, with ERROR in all caps.

  ERROR: hypothesis 4.38.2 has requirement attrs>=19.2.0, but you'll have attrs 19.1.0 which is incompatible.
  

• Use pip check as part of your CI, to make sure pip didn't do something stupid.
• Use pip-tools (wraps pip with a better resolver) or pipenv (which uses pip-tools) or poetry (which has it's own resolver), to avoid this quirk of pip's resolver.

[Zac-HD]

Ah, I see! I checked through the last few pages of issues, but nothing that far back... happy to close this issue as a duplicate, since I don't think it has any extra information?

[Zac-HD]

Closing as duplicate of #988.