Pipenv fails to honor version constraints

[matthewfranglen]

Issue description

Pipenv installs urllib3 at version 1.25.3 when there are constraints that require <1.25.

Expected result

Pipenv honors all version constraints or fails to install the packages with an error message.

Actual result

Installing docker-compose as a dev-package and elasticsearch as a package results in installing urllib3 version 1.25.3 which violates the constraint placed by docker-compose (via requests).

pipenv graph
docker-compose==1.24.1
  - cached-property [required: >=1.2.0,<2, installed: 1.5.1]
  - docker [required: >=3.7.0,<4.0, installed: 3.7.3]
    - docker-pycreds [required: >=0.4.0, installed: 0.4.0]
      - six [required: >=1.4.0, installed: 1.12.0]
    - requests [required: >=2.14.2,!=2.18.0, installed: 2.20.1]
      - certifi [required: >=2017.4.17, installed: 2019.6.16]
      - chardet [required: >=3.0.2,<3.1.0, installed: 3.0.4]
      - idna [required: >=2.5,<2.8, installed: 2.7]
      - urllib3 [required: >=1.21.1,<1.25, installed: 1.25.3]
    - six [required: >=1.4.0, installed: 1.12.0]
    - websocket-client [required: >=0.32.0, installed: 0.56.0]
      - six [required: Any, installed: 1.12.0]
  - dockerpty [required: >=0.4.1,<0.5, installed: 0.4.1]
    - six [required: >=1.3.0, installed: 1.12.0]
  - docopt [required: >=0.6.1,<0.7, installed: 0.6.2]
  - jsonschema [required: >=2.5.1,<3, installed: 2.6.0]
  - PyYAML [required: >=3.10,<4.3, installed: 3.13]
  - requests [required: >=2.6.1,<2.21,!=2.18.0,!=2.12.2,!=2.11.0, installed: 2.20.1]
    - certifi [required: >=2017.4.17, installed: 2019.6.16]
    - chardet [required: >=3.0.2,<3.1.0, installed: 3.0.4]
    - idna [required: >=2.5,<2.8, installed: 2.7]
    - urllib3 [required: >=1.21.1,<1.25, installed: 1.25.3]
  - six [required: >=1.3.0,<2, installed: 1.12.0]
  - texttable [required: >=0.9.0,<0.10, installed: 0.9.1]
  - websocket-client [required: >=0.32.0,<1.0, installed: 0.56.0]
    - six [required: Any, installed: 1.12.0]
elasticsearch==7.0.4
  - urllib3 [required: >=1.21.1, installed: 1.25.3]
paramiko==2.6.0
  - bcrypt [required: >=3.1.3, installed: 3.1.7]
    - cffi [required: >=1.1, installed: 1.12.3]
      - pycparser [required: Any, installed: 2.19]
    - six [required: >=1.4.1, installed: 1.12.0]
  - cryptography [required: >=2.5, installed: 2.7]
    - asn1crypto [required: >=0.21.0, installed: 0.24.0]
    - cffi [required: >=1.8,!=1.11.3, installed: 1.12.3]
      - pycparser [required: Any, installed: 2.19]
    - six [required: >=1.4.1, installed: 1.12.0]
  - pynacl [required: >=1.0.1, installed: 1.3.0]
    - cffi [required: >=1.4.1, installed: 1.12.3]
      - pycparser [required: Any, installed: 2.19]
    - six [required: Any, installed: 1.12.0]

pipenv lock --verbose
Locking [dev-packages] dependencies…
Using pip: -i https://pypi.org/simple
Using pip: -i https://pypi.org/simple
Using pip: -i https://pypi.org/simple

                          ROUND 1                           
Current constraints:
  docker-compose

Finding the best candidates:
  found candidate docker-compose==1.24.1 (constraint was <any>)

Finding secondary dependencies:
  docker-compose==1.24.1    requires cached-property<2,>=1.2.0, docker[ssh]<4.0,>=3.7.0, dockerpty<0.5,>=0.4.1, docopt<0.7,>=0.6.1, jsonschema<3,>=2.5.1, pyyaml<4.3,>=3.10, requests!=2.11.0,!=2.12.2,!=2.18.0,<2.21,>=2.6.1, six<2,>=1.3.0, texttable<0.10,>=0.9.0, websocket-client<1.0,>=0.32.0

New dependencies found in this round:
  adding ['cached-property', '<2,>=1.2.0', '[]']
  adding ['docker', '<4.0,>=3.7.0', "['ssh']"]
  adding ['dockerpty', '<0.5,>=0.4.1', '[]']
  adding ['docopt', '<0.7,>=0.6.1', '[]']
  adding ['jsonschema', '<3,>=2.5.1', '[]']
  adding ['pyyaml', '<4.3,>=3.10', '[]']
  adding ['requests', '!=2.11.0,!=2.12.2,!=2.18.0,<2.21,>=2.6.1', '[]']
  adding ['six', '<2,>=1.3.0', '[]']
  adding ['texttable', '<0.10,>=0.9.0', '[]']
  adding ['websocket-client', '<1.0,>=0.32.0', '[]']
Removed dependencies in this round:
Unsafe dependencies in this round:
------------------------------------------------------------
Result of round 1: not stable

                          ROUND 2                           
Current constraints:
  cached-property<2,>=1.2.0
  docker[ssh]<4.0,>=3.7.0
  docker-compose
  dockerpty<0.5,>=0.4.1
  docopt<0.7,>=0.6.1
  jsonschema<3,>=2.5.1
  pyyaml<4.3,>=3.10
  requests!=2.11.0,!=2.12.2,!=2.18.0,<2.21,>=2.6.1
  six<2,>=1.3.0
  texttable<0.10,>=0.9.0
  websocket-client<1.0,>=0.32.0

Finding the best candidates:
  found candidate cached-property==1.5.1 (constraint was >=1.2.0,<2)
  found candidate docker[ssh]==3.7.3 (constraint was >=3.7.0,<4.0)
  found candidate docker-compose==1.24.1 (constraint was <any>)
  found candidate dockerpty==0.4.1 (constraint was >=0.4.1,<0.5)
  found candidate docopt==0.6.2 (constraint was >=0.6.1,<0.7)
  found candidate jsonschema==2.6.0 (constraint was >=2.5.1,<3)
  found candidate pyyaml==3.13 (constraint was >=3.10,<4.3)
  found candidate requests==2.20.1 (constraint was !=2.11.0,!=2.12.2,!=2.18.0,<2.21,>=2.6.1)
  found candidate six==1.12.0 (constraint was >=1.3.0,<2)
  found candidate texttable==0.9.1 (constraint was <0.10,>=0.9.0)
  found candidate websocket-client==0.56.0 (constraint was >=0.32.0,<1.0)

Finding secondary dependencies:
  pyyaml==3.13              requires -
  jsonschema==2.6.0         requires -
  websocket-client==0.56.0  requires six
  docker[ssh]==3.7.3        requires docker-pycreds>=0.4.0, paramiko>=2.4.2; extra == "ssh", requests!=2.18.0,>=2.14.2, six>=1.4.0, websocket-client>=0.32.0
  requests==2.20.1          requires certifi>=2017.4.17, chardet<3.1.0,>=3.0.2, idna<2.8,>=2.5, urllib3<1.25,>=1.21.1
  docopt==0.6.2             requires -
  cached-property==1.5.1    requires -
  six==1.12.0               requires -
  texttable==0.9.1          requires -
  docker-compose==1.24.1    requires cached-property<2,>=1.2.0, docker[ssh]<4.0,>=3.7.0, dockerpty<0.5,>=0.4.1, docopt<0.7,>=0.6.1, jsonschema<3,>=2.5.1, pyyaml<4.3,>=3.10, requests!=2.11.0,!=2.12.2,!=2.18.0,<2.21,>=2.6.1, six<2,>=1.3.0, texttable<0.10,>=0.9.0, websocket-client<1.0,>=0.32.0
  dockerpty==0.4.1          requires six>=1.3.0

New dependencies found in this round:
  adding ['certifi', '>=2017.4.17', '[]']
  adding ['chardet', '<3.1.0,>=3.0.2', '[]']
  adding ['docker-pycreds', '>=0.4.0', '[]']
  adding ['idna', '<2.8,>=2.5', '[]']
  adding ['paramiko', '>=2.4.2', '[]']
  adding ['requests', '!=2.11.0,!=2.12.2,!=2.18.0,<2.21,>=2.14.2,>=2.6.1', '[]']
  adding ['six', '<2,>=1.3.0,>=1.4.0', '[]']
  adding ['urllib3', '<1.25,>=1.21.1', '[]']
Removed dependencies in this round:
  removing ['requests', '!=2.11.0,!=2.12.2,!=2.18.0,<2.21,>=2.6.1', '[]']
  removing ['six', '<2,>=1.3.0', '[]']
Unsafe dependencies in this round:
------------------------------------------------------------
Result of round 2: not stable

                          ROUND 3                           
Current constraints:
  cached-property<2,>=1.2.0
  certifi>=2017.4.17
  chardet<3.1.0,>=3.0.2
  docker[ssh]<4.0,>=3.7.0
  docker-compose
  docker-pycreds>=0.4.0
  dockerpty<0.5,>=0.4.1
  docopt<0.7,>=0.6.1
  idna<2.8,>=2.5
  jsonschema<3,>=2.5.1
  paramiko>=2.4.2
  pyyaml<4.3,>=3.10
  requests!=2.11.0,!=2.12.2,!=2.18.0,<2.21,>=2.14.2,>=2.6.1
  six<2,>=1.3.0,>=1.4.0
  texttable<0.10,>=0.9.0
  urllib3<1.25,>=1.21.1
  websocket-client<1.0,>=0.32.0

Finding the best candidates:
  found candidate cached-property==1.5.1 (constraint was >=1.2.0,<2)
  found candidate certifi==2019.6.16 (constraint was >=2017.4.17)
  found candidate chardet==3.0.4 (constraint was >=3.0.2,<3.1.0)
  found candidate docker[ssh]==3.7.3 (constraint was >=3.7.0,<4.0)
  found candidate docker-compose==1.24.1 (constraint was <any>)
  found candidate docker-pycreds==0.4.0 (constraint was >=0.4.0)
  found candidate dockerpty==0.4.1 (constraint was >=0.4.1,<0.5)
  found candidate docopt==0.6.2 (constraint was >=0.6.1,<0.7)
  found candidate idna==2.7 (constraint was >=2.5,<2.8)
  found candidate jsonschema==2.6.0 (constraint was >=2.5.1,<3)
  found candidate paramiko==2.6.0 (constraint was >=2.4.2)
  found candidate pyyaml==3.13 (constraint was >=3.10,<4.3)
  found candidate requests==2.20.1 (constraint was !=2.11.0,!=2.12.2,>=2.14.2,!=2.18.0,<2.21,>=2.6.1)
  found candidate six==1.12.0 (constraint was >=1.3.0,>=1.4.0,<2)
  found candidate texttable==0.9.1 (constraint was <0.10,>=0.9.0)
  found candidate urllib3==1.24.3 (constraint was >=1.21.1,<1.25)
  found candidate websocket-client==0.56.0 (constraint was >=0.32.0,<1.0)

Finding secondary dependencies:
  dockerpty==0.4.1          requires six>=1.3.0
  idna==2.7                 requires -
  requests==2.20.1          requires certifi>=2017.4.17, chardet<3.1.0,>=3.0.2, idna<2.8,>=2.5, urllib3<1.25,>=1.21.1
  cached-property==1.5.1    requires -
  docopt==0.6.2             requires -
  six==1.12.0               requires -
  pyyaml==3.13              requires -
  docker[ssh]==3.7.3        requires docker-pycreds>=0.4.0, paramiko>=2.4.2; extra == "ssh", requests!=2.18.0,>=2.14.2, six>=1.4.0, websocket-client>=0.32.0
  certifi==2019.6.16        requires -
  websocket-client==0.56.0  requires six
  docker-pycreds==0.4.0     requires six>=1.4.0
  jsonschema==2.6.0         requires -
  texttable==0.9.1          requires -
  chardet==3.0.4            requires -
  urllib3==1.24.3           requires -
  docker-compose==1.24.1    requires cached-property<2,>=1.2.0, docker[ssh]<4.0,>=3.7.0, dockerpty<0.5,>=0.4.1, docopt<0.7,>=0.6.1, jsonschema<3,>=2.5.1, pyyaml<4.3,>=3.10, requests!=2.11.0,!=2.12.2,!=2.18.0,<2.21,>=2.6.1, six<2,>=1.3.0, texttable<0.10,>=0.9.0, websocket-client<1.0,>=0.32.0
  paramiko==2.6.0           requires bcrypt>=3.1.3, cryptography>=2.5, pynacl>=1.0.1

New dependencies found in this round:
  adding ['bcrypt', '>=3.1.3', '[]']
  adding ['cryptography', '>=2.5', '[]']
  adding ['pynacl', '>=1.0.1', '[]']
Removed dependencies in this round:
Unsafe dependencies in this round:
------------------------------------------------------------
Result of round 3: not stable

                          ROUND 4                           
Current constraints:
  bcrypt>=3.1.3
  cached-property<2,>=1.2.0
  certifi>=2017.4.17
  chardet<3.1.0,>=3.0.2
  cryptography>=2.5
  docker[ssh]<4.0,>=3.7.0
  docker-compose
  docker-pycreds>=0.4.0
  dockerpty<0.5,>=0.4.1
  docopt<0.7,>=0.6.1
  idna<2.8,>=2.5
  jsonschema<3,>=2.5.1
  paramiko>=2.4.2
  pynacl>=1.0.1
  pyyaml<4.3,>=3.10
  requests!=2.11.0,!=2.12.2,!=2.18.0,<2.21,>=2.14.2,>=2.6.1
  six<2,>=1.3.0,>=1.4.0
  texttable<0.10,>=0.9.0
  urllib3<1.25,>=1.21.1
  websocket-client<1.0,>=0.32.0

Finding the best candidates:
  found candidate bcrypt==3.1.7 (constraint was >=3.1.3)
  found candidate cached-property==1.5.1 (constraint was >=1.2.0,<2)
  found candidate certifi==2019.6.16 (constraint was >=2017.4.17)
  found candidate chardet==3.0.4 (constraint was >=3.0.2,<3.1.0)
  found candidate cryptography==2.7 (constraint was >=2.5)
  found candidate docker[ssh]==3.7.3 (constraint was >=3.7.0,<4.0)
  found candidate docker-compose==1.24.1 (constraint was <any>)
  found candidate docker-pycreds==0.4.0 (constraint was >=0.4.0)
  found candidate dockerpty==0.4.1 (constraint was >=0.4.1,<0.5)
  found candidate docopt==0.6.2 (constraint was >=0.6.1,<0.7)
  found candidate idna==2.7 (constraint was >=2.5,<2.8)
  found candidate jsonschema==2.6.0 (constraint was >=2.5.1,<3)
  found candidate paramiko==2.6.0 (constraint was >=2.4.2)
  found candidate pynacl==1.3.0 (constraint was >=1.0.1)
  found candidate pyyaml==3.13 (constraint was >=3.10,<4.3)
  found candidate requests==2.20.1 (constraint was !=2.11.0,!=2.12.2,>=2.14.2,!=2.18.0,<2.21,>=2.6.1)
  found candidate six==1.12.0 (constraint was >=1.3.0,>=1.4.0,<2)
  found candidate texttable==0.9.1 (constraint was <0.10,>=0.9.0)
  found candidate urllib3==1.24.3 (constraint was >=1.21.1,<1.25)
  found candidate websocket-client==0.56.0 (constraint was >=0.32.0,<1.0)

Finding secondary dependencies:
  urllib3==1.24.3           requires -
  six==1.12.0               requires -
  pynacl==1.3.0             requires cffi>=1.4.1, six
  pyyaml==3.13              requires -
  chardet==3.0.4            requires -
  requests==2.20.1          requires certifi>=2017.4.17, chardet<3.1.0,>=3.0.2, idna<2.8,>=2.5, urllib3<1.25,>=1.21.1
  websocket-client==0.56.0  requires six
  docker[ssh]==3.7.3        requires docker-pycreds>=0.4.0, paramiko>=2.4.2; extra == "ssh", requests!=2.18.0,>=2.14.2, six>=1.4.0, websocket-client>=0.32.0
  docopt==0.6.2             requires -
  idna==2.7                 requires -
  cached-property==1.5.1    requires -
  bcrypt==3.1.7             requires cffi>=1.1, six>=1.4.1
  docker-pycreds==0.4.0     requires six>=1.4.0
  texttable==0.9.1          requires -
  paramiko==2.6.0           requires bcrypt>=3.1.3, cryptography>=2.5, pynacl>=1.0.1
  certifi==2019.6.16        requires -
  docker-compose==1.24.1    requires cached-property<2,>=1.2.0, docker[ssh]<4.0,>=3.7.0, dockerpty<0.5,>=0.4.1, docopt<0.7,>=0.6.1, jsonschema<3,>=2.5.1, pyyaml<4.3,>=3.10, requests!=2.11.0,!=2.12.2,!=2.18.0,<2.21,>=2.6.1, six<2,>=1.3.0, texttable<0.10,>=0.9.0, websocket-client<1.0,>=0.32.0
  jsonschema==2.6.0         requires -
  cryptography==2.7         requires asn1crypto>=0.21.0, cffi!=1.11.3,>=1.8, six>=1.4.1
  dockerpty==0.4.1          requires six>=1.3.0

New dependencies found in this round:
  adding ['asn1crypto', '>=0.21.0', '[]']
  adding ['cffi', '!=1.11.3,>=1.1,>=1.4.1,>=1.8', '[]']
  adding ['six', '<2,>=1.3.0,>=1.4.0,>=1.4.1', '[]']
Removed dependencies in this round:
  removing ['six', '<2,>=1.3.0,>=1.4.0', '[]']
Unsafe dependencies in this round:
------------------------------------------------------------
Result of round 4: not stable

                          ROUND 5                           
Current constraints:
  asn1crypto>=0.21.0
  bcrypt>=3.1.3
  cached-property<2,>=1.2.0
  certifi>=2017.4.17
  cffi!=1.11.3,>=1.1,>=1.4.1,>=1.8
  chardet<3.1.0,>=3.0.2
  cryptography>=2.5
  docker[ssh]<4.0,>=3.7.0
  docker-compose
  docker-pycreds>=0.4.0
  dockerpty<0.5,>=0.4.1
  docopt<0.7,>=0.6.1
  idna<2.8,>=2.5
  jsonschema<3,>=2.5.1
  paramiko>=2.4.2
  pynacl>=1.0.1
  pyyaml<4.3,>=3.10
  requests!=2.11.0,!=2.12.2,!=2.18.0,<2.21,>=2.14.2,>=2.6.1
  six<2,>=1.3.0,>=1.4.0,>=1.4.1
  texttable<0.10,>=0.9.0
  urllib3<1.25,>=1.21.1
  websocket-client<1.0,>=0.32.0

Finding the best candidates:
  found candidate asn1crypto==0.24.0 (constraint was >=0.21.0)
  found candidate bcrypt==3.1.7 (constraint was >=3.1.3)
  found candidate cached-property==1.5.1 (constraint was >=1.2.0,<2)
  found candidate certifi==2019.6.16 (constraint was >=2017.4.17)
  found candidate cffi==1.12.3 (constraint was >=1.1,!=1.11.3,>=1.4.1,>=1.8)
  found candidate chardet==3.0.4 (constraint was >=3.0.2,<3.1.0)
  found candidate cryptography==2.7 (constraint was >=2.5)
  found candidate docker[ssh]==3.7.3 (constraint was >=3.7.0,<4.0)
  found candidate docker-compose==1.24.1 (constraint was <any>)
  found candidate docker-pycreds==0.4.0 (constraint was >=0.4.0)
  found candidate dockerpty==0.4.1 (constraint was >=0.4.1,<0.5)
  found candidate docopt==0.6.2 (constraint was >=0.6.1,<0.7)
  found candidate idna==2.7 (constraint was >=2.5,<2.8)
  found candidate jsonschema==2.6.0 (constraint was >=2.5.1,<3)
  found candidate paramiko==2.6.0 (constraint was >=2.4.2)
  found candidate pynacl==1.3.0 (constraint was >=1.0.1)
  found candidate pyyaml==3.13 (constraint was >=3.10,<4.3)
  found candidate requests==2.20.1 (constraint was !=2.11.0,!=2.12.2,>=2.14.2,!=2.18.0,<2.21,>=2.6.1)
  found candidate six==1.12.0 (constraint was >=1.3.0,>=1.4.0,>=1.4.1,<2)
  found candidate texttable==0.9.1 (constraint was <0.10,>=0.9.0)
  found candidate urllib3==1.24.3 (constraint was >=1.21.1,<1.25)
  found candidate websocket-client==0.56.0 (constraint was >=0.32.0,<1.0)

Finding secondary dependencies:
  dockerpty==0.4.1          requires six>=1.3.0
  certifi==2019.6.16        requires -
  idna==2.7                 requires -
  texttable==0.9.1          requires -
  bcrypt==3.1.7             requires cffi>=1.1, six>=1.4.1
  urllib3==1.24.3           requires -
  paramiko==2.6.0           requires bcrypt>=3.1.3, cryptography>=2.5, pynacl>=1.0.1
  docker[ssh]==3.7.3        requires docker-pycreds>=0.4.0, paramiko>=2.4.2; extra == "ssh", requests!=2.18.0,>=2.14.2, six>=1.4.0, websocket-client>=0.32.0
  pyyaml==3.13              requires -
  requests==2.20.1          requires certifi>=2017.4.17, chardet<3.1.0,>=3.0.2, idna<2.8,>=2.5, urllib3<1.25,>=1.21.1
  websocket-client==0.56.0  requires six
  docker-compose==1.24.1    requires cached-property<2,>=1.2.0, docker[ssh]<4.0,>=3.7.0, dockerpty<0.5,>=0.4.1, docopt<0.7,>=0.6.1, jsonschema<3,>=2.5.1, pyyaml<4.3,>=3.10, requests!=2.11.0,!=2.12.2,!=2.18.0,<2.21,>=2.6.1, six<2,>=1.3.0, texttable<0.10,>=0.9.0, websocket-client<1.0,>=0.32.0
  pynacl==1.3.0             requires cffi>=1.4.1, six
  cffi==1.12.3              requires pycparser
  docopt==0.6.2             requires -
  asn1crypto==0.24.0        requires -
  chardet==3.0.4            requires -
  jsonschema==2.6.0         requires -
  cryptography==2.7         requires asn1crypto>=0.21.0, cffi!=1.11.3,>=1.8, six>=1.4.1
  docker-pycreds==0.4.0     requires six>=1.4.0
  cached-property==1.5.1    requires -
  six==1.12.0               requires -

New dependencies found in this round:
  adding ['pycparser', '', '[]']
Removed dependencies in this round:
Unsafe dependencies in this round:
------------------------------------------------------------
Result of round 5: not stable

                          ROUND 6                           
Current constraints:
  asn1crypto>=0.21.0
  bcrypt>=3.1.3
  cached-property<2,>=1.2.0
  certifi>=2017.4.17
  cffi!=1.11.3,>=1.1,>=1.4.1,>=1.8
  chardet<3.1.0,>=3.0.2
  cryptography>=2.5
  docker[ssh]<4.0,>=3.7.0
  docker-compose
  docker-pycreds>=0.4.0
  dockerpty<0.5,>=0.4.1
  docopt<0.7,>=0.6.1
  idna<2.8,>=2.5
  jsonschema<3,>=2.5.1
  paramiko>=2.4.2
  pycparser
  pynacl>=1.0.1
  pyyaml<4.3,>=3.10
  requests!=2.11.0,!=2.12.2,!=2.18.0,<2.21,>=2.14.2,>=2.6.1
  six<2,>=1.3.0,>=1.4.0,>=1.4.1
  texttable<0.10,>=0.9.0
  urllib3<1.25,>=1.21.1
  websocket-client<1.0,>=0.32.0

Finding the best candidates:
  found candidate asn1crypto==0.24.0 (constraint was >=0.21.0)
  found candidate bcrypt==3.1.7 (constraint was >=3.1.3)
  found candidate cached-property==1.5.1 (constraint was >=1.2.0,<2)
  found candidate certifi==2019.6.16 (constraint was >=2017.4.17)
  found candidate cffi==1.12.3 (constraint was >=1.1,!=1.11.3,>=1.4.1,>=1.8)
  found candidate chardet==3.0.4 (constraint was >=3.0.2,<3.1.0)
  found candidate cryptography==2.7 (constraint was >=2.5)
  found candidate docker[ssh]==3.7.3 (constraint was >=3.7.0,<4.0)
  found candidate docker-compose==1.24.1 (constraint was <any>)
  found candidate docker-pycreds==0.4.0 (constraint was >=0.4.0)
  found candidate dockerpty==0.4.1 (constraint was >=0.4.1,<0.5)
  found candidate docopt==0.6.2 (constraint was >=0.6.1,<0.7)
  found candidate idna==2.7 (constraint was >=2.5,<2.8)
  found candidate jsonschema==2.6.0 (constraint was >=2.5.1,<3)
  found candidate paramiko==2.6.0 (constraint was >=2.4.2)
  found candidate pycparser==2.19 (constraint was <any>)
  found candidate pynacl==1.3.0 (constraint was >=1.0.1)
  found candidate pyyaml==3.13 (constraint was >=3.10,<4.3)
  found candidate requests==2.20.1 (constraint was !=2.11.0,!=2.12.2,>=2.14.2,!=2.18.0,<2.21,>=2.6.1)
  found candidate six==1.12.0 (constraint was >=1.3.0,>=1.4.0,>=1.4.1,<2)
  found candidate texttable==0.9.1 (constraint was <0.10,>=0.9.0)
  found candidate urllib3==1.24.3 (constraint was >=1.21.1,<1.25)
  found candidate websocket-client==0.56.0 (constraint was >=0.32.0,<1.0)

Finding secondary dependencies:
  asn1crypto==0.24.0        requires -
  cryptography==2.7         requires asn1crypto>=0.21.0, cffi!=1.11.3,>=1.8, six>=1.4.1
  certifi==2019.6.16        requires -
  docker[ssh]==3.7.3        requires docker-pycreds>=0.4.0, paramiko>=2.4.2; extra == "ssh", requests!=2.18.0,>=2.14.2, six>=1.4.0, websocket-client>=0.32.0
  docker-compose==1.24.1    requires cached-property<2,>=1.2.0, docker[ssh]<4.0,>=3.7.0, dockerpty<0.5,>=0.4.1, docopt<0.7,>=0.6.1, jsonschema<3,>=2.5.1, pyyaml<4.3,>=3.10, requests!=2.11.0,!=2.12.2,!=2.18.0,<2.21,>=2.6.1, six<2,>=1.3.0, texttable<0.10,>=0.9.0, websocket-client<1.0,>=0.32.0
  idna==2.7                 requires -
  pyyaml==3.13              requires -
  cached-property==1.5.1    requires -
  six==1.12.0               requires -
  pynacl==1.3.0             requires cffi>=1.4.1, six
  bcrypt==3.1.7             requires cffi>=1.1, six>=1.4.1
  paramiko==2.6.0           requires bcrypt>=3.1.3, cryptography>=2.5, pynacl>=1.0.1
  websocket-client==0.56.0  requires six
  cffi==1.12.3              requires pycparser
  dockerpty==0.4.1          requires six>=1.3.0
  jsonschema==2.6.0         requires -
  chardet==3.0.4            requires -
  docopt==0.6.2             requires -
  pycparser==2.19           requires -
  urllib3==1.24.3           requires -
  docker-pycreds==0.4.0     requires six>=1.4.0
  requests==2.20.1          requires certifi>=2017.4.17, chardet<3.1.0,>=3.0.2, idna<2.8,>=2.5, urllib3<1.25,>=1.21.1
  texttable==0.9.1          requires -
------------------------------------------------------------
Result of round 6: stable, done


Locking [packages] dependencies…
Using pip: -i https://pypi.org/simple
Using pip: -i https://pypi.org/simple
Using pip: -i https://pypi.org/simple

                          ROUND 1                           
Current constraints:
  elasticsearch

Finding the best candidates:
  found candidate elasticsearch==7.0.4 (constraint was <any>)

Finding secondary dependencies:
  elasticsearch==7.0.4      requires urllib3>=1.21.1

New dependencies found in this round:
  adding ['urllib3', '>=1.21.1', '[]']
Removed dependencies in this round:
Unsafe dependencies in this round:
------------------------------------------------------------
Result of round 1: not stable

                          ROUND 2                           
Current constraints:
  elasticsearch
  urllib3>=1.21.1

Finding the best candidates:
  found candidate elasticsearch==7.0.4 (constraint was <any>)
  found candidate urllib3==1.25.3 (constraint was >=1.21.1)

Finding secondary dependencies:
  urllib3==1.25.3           requires -
  elasticsearch==7.0.4      requires urllib3>=1.21.1
------------------------------------------------------------
Result of round 2: stable, done


Updated Pipfile.lock (16be6f)!

Steps to replicate

$ pipenv --support

Pipenv version: '2018.11.26'

Pipenv location: '/home/matthew/.local/lib/python3.6/site-packages/pipenv'

Python location: '/usr/bin/python3'

Python installations found:

• 3.7.4: /home/matthew/.pyenv/versions/3.7.4/bin/python3.7m
• 3.7.4: /home/matthew/.pyenv/versions/3.7.4/bin/python3
• 3.7.3: /home/matthew/.pyenv/versions/3.7.3/bin/python3.7m
• 3.7.3: /home/matthew/.pyenv/versions/3.7.3/bin/python3
• 3.7.2: /home/matthew/.pyenv/versions/3.7.2/bin/python3.7m
• 3.7.2: /home/matthew/.pyenv/versions/3.7.2/bin/python3
• 3.7.1: /home/matthew/.pyenv/versions/3.7.1/bin/python3.7m
• 3.7.1: /home/matthew/.pyenv/versions/3.7.1/bin/python3
• 3.7.0: /home/matthew/.pyenv/versions/3.7.0/bin/python3.7m
• 3.7.0: /home/matthew/.pyenv/versions/3.7.0/bin/python3
• 3.6.8: /usr/bin/python3.6
• 3.6.8: /usr/bin/python3.6m
• 3.6.5: /home/matthew/.pyenv/versions/3.6.5/bin/python3.6m
• 3.6.5: /home/matthew/.pyenv/versions/3.6.5/bin/python3
• 3.6.4: /home/matthew/.pyenv/versions/3.6.4/bin/python3.6m
• 3.6.4: /home/matthew/.pyenv/versions/3.6.4/bin/python3
• 3.6.2: /home/matthew/.pyenv/versions/kafka-python/bin/python3
• 3.6.2: /home/matthew/.pyenv/versions/3.6.2/bin/python3.6m
• 3.6.1: /home/matthew/.pyenv/versions/cleaner/bin/python3
• 3.6.1: /home/matthew/.pyenv/versions/3.6.1/bin/python3.6m
• 3.6.0: /home/matthew/.pyenv/versions/pg-es-venv/bin/python3
• 3.6.0: /home/matthew/.pyenv/versions/3.6.0/bin/python3.6m
• 3.5.4: /home/matthew/.pyenv/versions/3.5.4/bin/python3.5m
• 3.5.4: /home/matthew/.pyenv/versions/3.5.4/bin/python3
• 3.4.2: /home/matthew/.pyenv/versions/3.4.2/bin/python3.4m
• 3.4.2: /home/matthew/.pyenv/versions/3.4.2/bin/python3
• 2.7.15: /usr/bin/python2
• 2.7.13: /home/matthew/.pyenv/versions/2.7.13/bin/python2.7

PEP 508 Information:

{'implementation_name': 'cpython',
 'implementation_version': '3.6.8',
 'os_name': 'posix',
 'platform_machine': 'x86_64',
 'platform_python_implementation': 'CPython',
 'platform_release': '4.15.0-23-generic',
 'platform_system': 'Linux',
 'platform_version': '#25-Ubuntu SMP Wed May 23 18:02:16 UTC 2018',
 'python_full_version': '3.6.8',
 'python_version': '3.6',
 'sys_platform': 'linux'}

System environment variables:

• CLUTTER_IM_MODULE
• COLORTERM
• DBUS_SESSION_BUS_ADDRESS
• DEFAULTS_PATH
• DERBY_HOME
• DESKTOP_SESSION
• DISPLAY
• GDMSESSION
• GJS_DEBUG_OUTPUT
• GJS_DEBUG_TOPICS
• GNOME_DESKTOP_SESSION_ID
• GNOME_SHELL_SESSION_MODE
• GNOME_TERMINAL_SCREEN
• GNOME_TERMINAL_SERVICE
• GPG_AGENT_INFO
• GTK2_MODULES
• GTK_IM_MODULE
• GTK_MODULES
• HOME
• IM_CONFIG_PHASE
• J2REDIR
• J2SDKDIR
• JAVA_HOME
• LANG
• LANGUAGE
• LOGNAME
• MANDATORY_PATH
• PATH
• POWERLINE_COMMAND
• PWD
• QT4_IM_MODULE
• QT_ACCESSIBILITY
• QT_IM_MODULE
• QT_QPA_PLATFORMTHEME
• SESSION_MANAGER
• SHELL
• SHLVL
• SSH_AGENT_PID
• SSH_AUTH_SOCK
• S_COLORS
• TERM
• TEXTDOMAIN
• TEXTDOMAINDIR
• TMUX
• TMUX_PANE
• TMUX_PLUGIN_MANAGER_PATH
• USER
• USERNAME
• VTE_VERSION
• WINDOWPATH
• XAUTHORITY
• XDG_CONFIG_DIRS
• XDG_CURRENT_DESKTOP
• XDG_DATA_DIRS
• XDG_MENU_PREFIX
• XDG_RUNTIME_DIR
• XDG_SEAT
• XDG_SESSION_DESKTOP
• XDG_SESSION_ID
• XDG_SESSION_TYPE
• XDG_VTNR
• XMODIFIERS
• OLDPWD
• ZSH
• PAGER
• LESS
• LSCOLORS
• LS_COLORS
• PYENV_ROOT
• PYENV_SHELL
• PYENV_VIRTUALENV_INIT
• KEYTIMEOUT
• VISUAL
• EDITOR
• SVN_EDITOR
• GIT_EDITOR
• UBUNTU_MENUPROXY
• FZF_DEFAULT_OPTS
• FZF_DEFAULT_COMMAND
• VIRTUAL_ENV_DISABLE_PROMPT
• ANTIBODY_HOME
• ZSH_AUTOSUGGEST_HIGHLIGHT_STYLE
• SDKMAN_DIR
• SDKMAN_PLATFORM
• SDKMAN_VERSION
• SDKMAN_CANDIDATES_API
• SDKMAN_CANDIDATES_DIR
• GRADLE_HOME
• LC_ALL
• LC_CTYPE
• DEFAULT_USER
• _
• PIP_DISABLE_PIP_VERSION_CHECK
• PYTHONDONTWRITEBYTECODE
• PIP_SHIMS_BASE_MODULE
• PIP_PYTHON_PATH
• PYTHONFINDER_IGNORE_UNSUPPORTED

Pipenv–specific environment variables:

Debug–specific environment variables:

• PATH: /home/matthew/.pyenv/plugins/pyenv-virtualenv/shims:/home/matthew/.pyenv/shims:/home/matthew/.pyenv/bin:/home/matthew/.sdkman/candidates/gradle/current/bin:/home/matthew/.pyenv/plugins/pyenv-virtualenv/shims:/home/matthew/.pyenv/shims:/home/matthew/.pyenv/bin:/home/matthew/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/usr/lib/jvm/java-8-oracle/bin:/usr/lib/jvm/java-8-oracle/db/bin:/usr/lib/jvm/java-8-oracle/jre/bin:/home/matthew/.gem/ruby/1.9.1/bin:/home/matthew/.gem/ruby/2.3.0/bin:/home/matthew/.gem/ruby/2.5.0/bin:/home/matthew/.antibody/https-COLON--SLASH--SLASH-gitlab.com-SLASH-matthewfranglen-SLASH-docker-go/bin:/home/matthew/.antibody/https-COLON--SLASH--SLASH-gitlab.com-SLASH-matthewfranglen-SLASH-format-python:/home/matthew/.antibody/https-COLON--SLASH--SLASH-gitlab.com-SLASH-matthewfranglen-SLASH-git-stashes:/home/matthew/.antibody/https-COLON--SLASH--SLASH-gitlab.com-SLASH-matthewfranglen-SLASH-random:/home/matthew/.antibody/https-COLON--SLASH--SLASH-github.com-SLASH-matthewfranglen-SLASH-gitflow-avh:/home/matthew/.fzf/bin
• SHELL: /bin/zsh
• EDITOR: vim
• LANG: en_GB.UTF-8
• PWD: /home/matthew/test/pipenv-constraint-failure

---

Contents of Pipfile ('/home/matthew/tmp/pipenv-constraint-failure/Pipfile'):

[[source]]
name = "pypi"
url = "https://pypi.org/simple"
verify_ssl = true

[dev-packages]
docker-compose = "*"

[packages]
elasticsearch = "*"

[requires]
python_version = "3.7"

Contents of Pipfile.lock ('/home/matthew/tmp/pipenv-constraint-failure/Pipfile.lock'):

{
    "_meta": {
        "hash": {
            "sha256": "417b5705ec1be0f90a9d402b9fe556c8d94f8c706b7d65ce17eb9ed03d16be6f"
        },
        "pipfile-spec": 6,
        "requires": {
            "python_version": "3.7"
        },
        "sources": [
            {
                "name": "pypi",
                "url": "https://pypi.org/simple",
                "verify_ssl": true
            }
        ]
    },
    "default": {
        "elasticsearch": {
            "hashes": [
                "sha256:1ec2ed8ff9994a0b0961081f053c90819696c0d03da204b61b79d416606dd055",
                "sha256:d9eda8d9696f55d7d394ade625a262985d7af762c0b9305b73d421dace41c4e7"
            ],
            "index": "pypi",
            "version": "==7.0.4"
        },
        "urllib3": {
            "hashes": [
                "sha256:b246607a25ac80bedac05c6f282e3cdaf3afb65420fd024ac94435cabe6e18d1",
                "sha256:dbe59173209418ae49d485b87d1681aefa36252ee85884c31346debd19463232"
            ],
            "version": "==1.25.3"
        }
    },
    "develop": {
        "asn1crypto": {
            "hashes": [
                "sha256:2f1adbb7546ed199e3c90ef23ec95c5cf3585bac7d11fb7eb562a3fe89c64e87",
                "sha256:9d5c20441baf0cb60a4ac34cc447c6c189024b6b4c6cd7877034f4965c464e49"
            ],
            "version": "==0.24.0"
        },
        "bcrypt": {
            "hashes": [
                "sha256:0258f143f3de96b7c14f762c770f5fc56ccd72f8a1857a451c1cd9a655d9ac89",
                "sha256:0b0069c752ec14172c5f78208f1863d7ad6755a6fae6fe76ec2c80d13be41e42",
                "sha256:19a4b72a6ae5bb467fea018b825f0a7d917789bcfe893e53f15c92805d187294",
                "sha256:5432dd7b34107ae8ed6c10a71b4397f1c853bd39a4d6ffa7e35f40584cffd161",
                "sha256:69361315039878c0680be456640f8705d76cb4a3a3fe1e057e0f261b74be4b31",
                "sha256:6fe49a60b25b584e2f4ef175b29d3a83ba63b3a4df1b4c0605b826668d1b6be5",
                "sha256:74a015102e877d0ccd02cdeaa18b32aa7273746914a6c5d0456dd442cb65b99c",
                "sha256:763669a367869786bb4c8fcf731f4175775a5b43f070f50f46f0b59da45375d0",
                "sha256:8b10acde4e1919d6015e1df86d4c217d3b5b01bb7744c36113ea43d529e1c3de",
                "sha256:9fe92406c857409b70a38729dbdf6578caf9228de0aef5bc44f859ffe971a39e",
                "sha256:a190f2a5dbbdbff4b74e3103cef44344bc30e61255beb27310e2aec407766052",
                "sha256:a595c12c618119255c90deb4b046e1ca3bcfad64667c43d1166f2b04bc72db09",
                "sha256:c9457fa5c121e94a58d6505cadca8bed1c64444b83b3204928a866ca2e599105",
                "sha256:cb93f6b2ab0f6853550b74e051d297c27a638719753eb9ff66d1e4072be67133",
                "sha256:d7bdc26475679dd073ba0ed2766445bb5b20ca4793ca0db32b399dccc6bc84b7",
                "sha256:ff032765bb8716d9387fd5376d987a937254b0619eff0972779515b5c98820bc"
            ],
            "version": "==3.1.7"
        },
        "cached-property": {
            "hashes": [
                "sha256:3a026f1a54135677e7da5ce819b0c690f156f37976f3e30c5430740725203d7f",
                "sha256:9217a59f14a5682da7c4b8829deadbfc194ac22e9908ccf7c8820234e80a1504"
            ],
            "version": "==1.5.1"
        },
        "certifi": {
            "hashes": [
                "sha256:046832c04d4e752f37383b628bc601a7ea7211496b4638f6514d0e5b9acc4939",
                "sha256:945e3ba63a0b9f577b1395204e13c3a231f9bc0223888be653286534e5873695"
            ],
            "version": "==2019.6.16"
        },
        "cffi": {
            "hashes": [
                "sha256:041c81822e9f84b1d9c401182e174996f0bae9991f33725d059b771744290774",
                "sha256:046ef9a22f5d3eed06334d01b1e836977eeef500d9b78e9ef693f9380ad0b83d",
                "sha256:066bc4c7895c91812eff46f4b1c285220947d4aa46fa0a2651ff85f2afae9c90",
                "sha256:066c7ff148ae33040c01058662d6752fd73fbc8e64787229ea8498c7d7f4041b",
                "sha256:2444d0c61f03dcd26dbf7600cf64354376ee579acad77aef459e34efcb438c63",
                "sha256:300832850b8f7967e278870c5d51e3819b9aad8f0a2c8dbe39ab11f119237f45",
                "sha256:34c77afe85b6b9e967bd8154e3855e847b70ca42043db6ad17f26899a3df1b25",
                "sha256:46de5fa00f7ac09f020729148ff632819649b3e05a007d286242c4882f7b1dc3",
                "sha256:4aa8ee7ba27c472d429b980c51e714a24f47ca296d53f4d7868075b175866f4b",
                "sha256:4d0004eb4351e35ed950c14c11e734182591465a33e960a4ab5e8d4f04d72647",
                "sha256:4e3d3f31a1e202b0f5a35ba3bc4eb41e2fc2b11c1eff38b362de710bcffb5016",
                "sha256:50bec6d35e6b1aaeb17f7c4e2b9374ebf95a8975d57863546fa83e8d31bdb8c4",
                "sha256:55cad9a6df1e2a1d62063f79d0881a414a906a6962bc160ac968cc03ed3efcfb",
                "sha256:5662ad4e4e84f1eaa8efce5da695c5d2e229c563f9d5ce5b0113f71321bcf753",
                "sha256:59b4dc008f98fc6ee2bb4fd7fc786a8d70000d058c2bbe2698275bc53a8d3fa7",
                "sha256:73e1ffefe05e4ccd7bcea61af76f36077b914f92b76f95ccf00b0c1b9186f3f9",
                "sha256:a1f0fd46eba2d71ce1589f7e50a9e2ffaeb739fb2c11e8192aa2b45d5f6cc41f",
                "sha256:a2e85dc204556657661051ff4bab75a84e968669765c8a2cd425918699c3d0e8",
                "sha256:a5457d47dfff24882a21492e5815f891c0ca35fefae8aa742c6c263dac16ef1f",
                "sha256:a8dccd61d52a8dae4a825cdbb7735da530179fea472903eb871a5513b5abbfdc",
                "sha256:ae61af521ed676cf16ae94f30fe202781a38d7178b6b4ab622e4eec8cefaff42",
                "sha256:b012a5edb48288f77a63dba0840c92d0504aa215612da4541b7b42d849bc83a3",
                "sha256:d2c5cfa536227f57f97c92ac30c8109688ace8fa4ac086d19d0af47d134e2909",
                "sha256:d42b5796e20aacc9d15e66befb7a345454eef794fdb0737d1af593447c6c8f45",
                "sha256:dee54f5d30d775f525894d67b1495625dd9322945e7fee00731952e0368ff42d",
                "sha256:e070535507bd6aa07124258171be2ee8dfc19119c28ca94c9dfb7efd23564512",
                "sha256:e1ff2748c84d97b065cc95429814cdba39bcbd77c9c85c89344b317dc0d9cbff",
                "sha256:ed851c75d1e0e043cbf5ca9a8e1b13c4c90f3fbd863dacb01c0808e2b5204201"
            ],
            "version": "==1.12.3"
        },
        "chardet": {
            "hashes": [
                "sha256:84ab92ed1c4d4f16916e05906b6b75a6c0fb5db821cc65e70cbd64a3e2a5eaae",
                "sha256:fc323ffcaeaed0e0a02bf4d117757b98aed530d9ed4531e3e15460124c106691"
            ],
            "version": "==3.0.4"
        },
        "cryptography": {
            "hashes": [
                "sha256:24b61e5fcb506424d3ec4e18bca995833839bf13c59fc43e530e488f28d46b8c",
                "sha256:25dd1581a183e9e7a806fe0543f485103232f940fcfc301db65e630512cce643",
                "sha256:3452bba7c21c69f2df772762be0066c7ed5dc65df494a1d53a58b683a83e1216",
                "sha256:41a0be220dd1ed9e998f5891948306eb8c812b512dc398e5a01846d855050799",
                "sha256:5751d8a11b956fbfa314f6553d186b94aa70fdb03d8a4d4f1c82dcacf0cbe28a",
                "sha256:5f61c7d749048fa6e3322258b4263463bfccefecb0dd731b6561cb617a1d9bb9",
                "sha256:72e24c521fa2106f19623a3851e9f89ddfdeb9ac63871c7643790f872a305dfc",
                "sha256:7b97ae6ef5cba2e3bb14256625423413d5ce8d1abb91d4f29b6d1a081da765f8",
                "sha256:961e886d8a3590fd2c723cf07be14e2a91cf53c25f02435c04d39e90780e3b53",
                "sha256:96d8473848e984184b6728e2c9d391482008646276c3ff084a1bd89e15ff53a1",
                "sha256:ae536da50c7ad1e002c3eee101871d93abdc90d9c5f651818450a0d3af718609",
                "sha256:b0db0cecf396033abb4a93c95d1602f268b3a68bb0a9cc06a7cff587bb9a7292",
                "sha256:cfee9164954c186b191b91d4193989ca994703b2fff406f71cf454a2d3c7327e",
                "sha256:e6347742ac8f35ded4a46ff835c60e68c22a536a8ae5c4422966d06946b6d4c6",
                "sha256:f27d93f0139a3c056172ebb5d4f9056e770fdf0206c2f422ff2ebbad142e09ed",
                "sha256:f57b76e46a58b63d1c6375017f4564a28f19a5ca912691fd2e4261b3414b618d"
            ],
            "version": "==2.7"
        },
        "docker": {
            "extras": [
                "ssh"
            ],
            "hashes": [
                "sha256:2434b396e616a5ef682fbf80e04839a59e8b81880ece5662c33dff34b8863519",
                "sha256:a062a9f82dff025f79c2097c46f49f143f8898274db7e66041f78cafee66b962"
            ],
            "version": "==3.7.3"
        },
        "docker-compose": {
            "hashes": [
                "sha256:59babecccf76c3c9d796f69b463f3ad5410d03d69e074b299bf3bf4b222aaf5c",
                "sha256:a5d58e974fd717e24b0dda6669a46bc03548d9023ef38d965acdc32d4d5fa753"
            ],
            "index": "pypi",
            "version": "==1.24.1"
        },
        "docker-pycreds": {
            "hashes": [
                "sha256:6ce3270bcaf404cc4c3e27e4b6c70d3521deae82fb508767870fdbf772d584d4",
                "sha256:7266112468627868005106ec19cd0d722702d2b7d5912a28e19b826c3d37af49"
            ],
            "version": "==0.4.0"
        },
        "dockerpty": {
            "hashes": [
                "sha256:69a9d69d573a0daa31bcd1c0774eeed5c15c295fe719c61aca550ed1393156ce"
            ],
            "version": "==0.4.1"
        },
        "docopt": {
            "hashes": [
                "sha256:49b3a825280bd66b3aa83585ef59c4a8c82f2c8a522dbe754a8bc8d08c85c491"
            ],
            "version": "==0.6.2"
        },
        "idna": {
            "hashes": [
                "sha256:156a6814fb5ac1fc6850fb002e0852d56c0c8d2531923a51032d1b70760e186e",
                "sha256:684a38a6f903c1d71d6d5fac066b58d7768af4de2b832e426ec79c30daa94a16"
            ],
            "version": "==2.7"
        },
        "jsonschema": {
            "hashes": [
                "sha256:000e68abd33c972a5248544925a0cae7d1125f9bf6c58280d37546b946769a08",
                "sha256:6ff5f3180870836cae40f06fa10419f557208175f13ad7bc26caa77beb1f6e02"
            ],
            "version": "==2.6.0"
        },
        "paramiko": {
            "hashes": [
                "sha256:99f0179bdc176281d21961a003ffdb2ec369daac1a1007241f53374e376576cf",
                "sha256:f4b2edfa0d226b70bd4ca31ea7e389325990283da23465d572ed1f70a7583041"
            ],
            "version": "==2.6.0"
        },
        "pycparser": {
            "hashes": [
                "sha256:a988718abfad80b6b157acce7bf130a30876d27603738ac39f140993246b25b3"
            ],
            "version": "==2.19"
        },
        "pynacl": {
            "hashes": [
                "sha256:05c26f93964373fc0abe332676cb6735f0ecad27711035b9472751faa8521255",
                "sha256:0c6100edd16fefd1557da078c7a31e7b7d7a52ce39fdca2bec29d4f7b6e7600c",
                "sha256:0d0a8171a68edf51add1e73d2159c4bc19fc0718e79dec51166e940856c2f28e",
                "sha256:1c780712b206317a746ace34c209b8c29dbfd841dfbc02aa27f2084dd3db77ae",
                "sha256:2424c8b9f41aa65bbdbd7a64e73a7450ebb4aa9ddedc6a081e7afcc4c97f7621",
                "sha256:2d23c04e8d709444220557ae48ed01f3f1086439f12dbf11976e849a4926db56",
                "sha256:30f36a9c70450c7878053fa1344aca0145fd47d845270b43a7ee9192a051bf39",
                "sha256:37aa336a317209f1bb099ad177fef0da45be36a2aa664507c5d72015f956c310",
                "sha256:4943decfc5b905748f0756fdd99d4f9498d7064815c4cf3643820c9028b711d1",
                "sha256:57ef38a65056e7800859e5ba9e6091053cd06e1038983016effaffe0efcd594a",
                "sha256:5bd61e9b44c543016ce1f6aef48606280e45f892a928ca7068fba30021e9b786",
                "sha256:6482d3017a0c0327a49dddc8bd1074cc730d45db2ccb09c3bac1f8f32d1eb61b",
                "sha256:7d3ce02c0784b7cbcc771a2da6ea51f87e8716004512493a2b69016326301c3b",
                "sha256:a14e499c0f5955dcc3991f785f3f8e2130ed504fa3a7f44009ff458ad6bdd17f",
                "sha256:a39f54ccbcd2757d1d63b0ec00a00980c0b382c62865b61a505163943624ab20",
                "sha256:aabb0c5232910a20eec8563503c153a8e78bbf5459490c49ab31f6adf3f3a415",
                "sha256:bd4ecb473a96ad0f90c20acba4f0bf0df91a4e03a1f4dd6a4bdc9ca75aa3a715",
                "sha256:e2da3c13307eac601f3de04887624939aca8ee3c9488a0bb0eca4fb9401fc6b1",
                "sha256:f67814c38162f4deb31f68d590771a29d5ae3b1bd64b75cf232308e5c74777e0"
            ],
            "version": "==1.3.0"
        },
        "pyyaml": {
            "hashes": [
                "sha256:3d7da3009c0f3e783b2c873687652d83b1bbfd5c88e9813fb7e5b03c0dd3108b",
                "sha256:3ef3092145e9b70e3ddd2c7ad59bdd0252a94dfe3949721633e41344de00a6bf",
                "sha256:40c71b8e076d0550b2e6380bada1f1cd1017b882f7e16f09a65be98e017f211a",
                "sha256:558dd60b890ba8fd982e05941927a3911dc409a63dcb8b634feaa0cda69330d3",
                "sha256:a7c28b45d9f99102fa092bb213aa12e0aaf9a6a1f5e395d36166639c1f96c3a1",
                "sha256:aa7dd4a6a427aed7df6fb7f08a580d68d9b118d90310374716ae90b710280af1",
                "sha256:bc558586e6045763782014934bfaf39d48b8ae85a2713117d16c39864085c613",
                "sha256:d46d7982b62e0729ad0175a9bc7e10a566fc07b224d2c79fafb5e032727eaa04",
                "sha256:d5eef459e30b09f5a098b9cea68bebfeb268697f78d647bd255a085371ac7f3f",
                "sha256:e01d3203230e1786cd91ccfdc8f8454c8069c91bee3962ad93b87a4b2860f537",
                "sha256:e170a9e6fcfd19021dd29845af83bb79236068bf5fd4df3327c1be18182b2531"
            ],
            "version": "==3.13"
        },
        "requests": {
            "hashes": [
                "sha256:65b3a120e4329e33c9889db89c80976c5272f56ea92d3e74da8a463992e3ff54",
                "sha256:ea881206e59f41dbd0bd445437d792e43906703fff75ca8ff43ccdb11f33f263"
            ],
            "version": "==2.20.1"
        },
        "six": {
            "hashes": [
                "sha256:3350809f0555b11f552448330d0b52d5f24c91a322ea4a15ef22629740f3761c",
                "sha256:d16a0141ec1a18405cd4ce8b4613101da75da0e9a7aec5bdd4fa804d0e0eba73"
            ],
            "version": "==1.12.0"
        },
        "texttable": {
            "hashes": [
                "sha256:119041773ff03596b56392532f9315cb3a3116e404fd6f36e76a7dc088d95c79"
            ],
            "version": "==0.9.1"
        },
        "urllib3": {
            "hashes": [
                "sha256:b246607a25ac80bedac05c6f282e3cdaf3afb65420fd024ac94435cabe6e18d1",
                "sha256:dbe59173209418ae49d485b87d1681aefa36252ee85884c31346debd19463232"
            ],
            "version": "==1.25.3"
        },
        "websocket-client": {
            "hashes": [
                "sha256:1151d5fb3a62dc129164292e1227655e4bbc5dd5340a5165dfae61128ec50aa9",
                "sha256:1fd5520878b68b84b5748bb30e592b10d0a91529d5383f74f4964e72b297fd3a"
            ],
            "version": "==0.56.0"
        }
    }
}

[matthewfranglen]

From reading the locking output it appears to correctly establish the urllib3 constraint during the first section (installing the dev-packages) and then discards them when establishing constraints during the second section (installing the packages).

I can understand the desire to have a single Pipfile.lock which supports only installing the packages (and not the dev packages) while maintaining a single set of dependency versions, however this breaks things. I found this when I installed twine as a dev package and it was broken due to the urllib3 dependency version. I had to use pip within the virtualenv to force downgrade urllib3.

[frostming]

@matthewfranglen What is your proposal for this situation?

people only want to install default packages but it fails because there are conflicting dependencies between develop dependencies.

[matthewfranglen]

In this situation there is a resolution available which is to use the urllib3 library with the intersection of the constraints (i.e. >=1.21.1,<1.25).

I feel that the guiding principle here should be that:

• Installing just the regular packages works
• Installing the regular packages and the dev packages works

The dev packages were added at some point by the author of whatever the project is so at that point it would be appropriate to check that they can be satisfied (and error appropriately if not). If the dev packages + regular packages work then the regular packages will also work on their own.

Otherwise in order to use the dev packages you need to hoist the constraints to the regular packages where they do not belong, which is a time consuming and opaque process.

[matteius]

There are a number of issues tracking this same problem in the backlog -- I am proposing we leave the default behavior of default overrides develop, but provide an option that can be added to the [pipenv] section of the Pipfile to not use the constraints on the develop group.