hey all, is it possible to override the version of a transitive dependency in a`python_distribution`??

the version comes from the lockfile, and there’s no version field for dependencies beyond the

python_requirement

target, so no, you can not override that on the

python_distribution

. What’s the motivation to override it?

for example upgrading a transitive dependency due to security issues

if you’re using lockfiles, regenerating the lockfile should pick up the latest available compatible versions, so unless there’s a pin on the transitive dependency that should get the upgrade.

and if there is a pin to a particular version?

if you have a dep chain like: A -> B -> C. Where there is a new security fix released for C, and you depend on A, and B has a pin on C, you need to fork or otherwise get B updated. This would be true also without pants in the picture..

yeap agreed this is true with/without pants, thanks.

you can only ignore dependencies from your project.. the terminology is kind of fuzzy here, so if you have a transitive dependency (within your project) to some third party library (a python_requirement target, say) then you can exclude that with a

!!target-address

in the dependencies field of any of your targets.. but you can’t exclude transitive dependencies that go beyond the targets you have declared, if that makes sense.

gotcha, I think I follow what you mean

I was looking into similar functionality as we wanted to pin one of the transitive dependencies. The issue is that

python_distribution

will only add your direct dependencies to METADATA file (for wheel), leaving dependency resolution to pip when you install your distribution. You can add your transitive dependency to the distribution as Andreas suggested (so you create

python_requirement

for it and then you add it to

python_distribution

under either

dependencies

or inside one of your sources). But that would increase the size of your package. One of the options that I am considering is to use pip's constraints file. If you ship it alongside your Python distribution file, you can then install it with

pip install --constraint constraint.txt your_distribution_file

.