#23407 generate-lockfiles --sync ignores requested dependency versions Issue created by tim-werner Describe the bug In a pyproject.toml file in my repo I have set the dependencies to:

"paramiko>=3.5.0,<=4.0.0"

However, when running generate-lockfiles with the --sync flag the upper bound is ignored.

pants generate-lockfiles --resolve=python-default --sync
17:21:45.28 [INFO] Completed: Generate pex lockfile for python-default
17:21:45.31 [INFO] Wrote lockfile for the resolve `python-default` to 3rdparty/python/default.lock

Lockfile diff: 3rdparty/python/default.lock [python-default]

==                    Upgraded dependencies                     ==

  paramiko                       4.0.0        -->   5.0.0

Running the same with the --no-sync flag results into downgrading it again (respecting the pinned version, how it should be):

17:31:29.10 [INFO] Completed: Generate pex lockfile for python-default
17:31:29.13 [INFO] Wrote lockfile for the resolve `python-default` to 3rdparty/python/default.lock

Lockfile diff: 3rdparty/python/default.lock [python-default]

==                !! Downgraded dependencies !!                 ==

  paramiko                       5.0.0        -->   4.0.0

Pants version 2.32.0 OS both? pantsbuild/pants