Azure / Azure/azure-cli

cli-core: pinning msal to beta in 2.41.0 causes dependency conflict

Open
#24,373 1 comment 0 reactions 1 assignee Claimed by @jiasli View on GitHub
act-platform-engineering-squad Azure CLI Team Core customer-reported feature-request MSAL
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

Can we please have this change: https://github.com/Azure/azure-cli/commit/c6abf9e43d5474373a8875f0cfef81cc95240f1f#diff-37e5a736993fcaf4777f4364e5ac8788749b56f7b28e64bd7ee9f1d4b3e6eb22R54 in a hotfix release?

Pinning `msal[broker]==1.20.0b1` causes the follwing dependency conflict:

```
There are incompatible versions in the resolved dependencies:
msal<2.0.0,>=1.12.0 (from azure-identity==1.11.0->-r /run/user/1000/pipenv7fg1ziurrequirements/pipenv-8hona6xp-constraints.txt (line 23))
msal[broker]==1.20.0b1 (from azure-cli-core==2.41.0->-r /run/user/1000/pipenv7fg1ziurrequirements/pipenv-8hona6xp-constraints.txt (line 50))
```

Because pre-releases, alphas and betas are not allowed by default.

On a general note, please take more care in not pinning dependencies too tightly in `setup.py`. Dependency hell is not a pleasant place to be in. Users need a bit of leeway with your dependencies because Azure libraries are not used in a vacuum. The `requirement.txt` file or package installer lock files (pipenv, poetry, flit, ...) are the place to hard-pin dependencies in the pythonic packaging paradigm, not `setup.py`.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.