Conditional soupsieve dependency constraint should be specified per PEP 508

Bug #1893696 reported by Mike Nerone
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Beautiful Soup
Fix Released
Undecided
Mike Nerone

Bug Description

BS4's setup.py currently contains:

install_requires=["soupsieve>1.2"]
if sys.version_info.major == 2:
    install_requires.append("soupsieve<2.0")

As you can see in this response, PyPI advertises only one set of requirements for a release:

# Note no whl file or Py-version specificity in the URL or JSON paths
curl https://pypi.org/pypi/beautifulsoup4/json | jq .info.requires_dist
[
  "soupsieve (>1.2)",
  "soupsieve (<2.0)",
  "html5lib; extra == 'html5lib'",
  "lxml; extra == 'lxml'"
]

This impacts resolution of the dependency tree for modern dep management tools (like Poetry) that use PyPI metadata, erroneously causing them to select soupsieve<2.0 even for Python 3. It's impossible to determine actual requirements short of downloading all of the individual whl files (or worse, downloading the sdist and executing setup.py). Note: this only even works for pip right now because it's not yet smart enough to have a dependency resolver (which raises a whole different set of problems), but that might become affected very soon, as well, because it's about to get one: see https://github.com/pypa/pip/issues/988#issuecomment-666464268.

The soupsieve dependency should instead be specified with PEP 508 environment markers. This will resolve the issue with PyPI's metadata for beautifulsoup while remaining compatible with pip, as well (which has supported PEP 508 since May 2016).

Related branches

Revision history for this message
Leonard Richardson (leonardr) wrote :

Merged as revision 585.

Changed in beautifulsoup:
status: New → Fix Committed
Mike Nerone (mikenerone)
Changed in beautifulsoup:
assignee: nobody → Mike Nerone (mikenerone)
Changed in beautifulsoup:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.