Skip to content

Conversation

matteius
Copy link
Member

@matteius matteius commented Jun 26, 2025

The issue

This patch was mistakenly dropped during the last pip vendoring update, which caused #6423

Add ignore_compatibility option to pip package finder for comprehensive lock file generation

Summary

This PR restores and formalizes the ignore_compatibility patch for pip's package finder, enabling Pipenv to include all relevant package hashes in lock files regardless of platform compatibility constraints.

Problem

Currently, pip's package finder filters out packages based on platform compatibility (wheel tags, Python version requirements, etc.), which prevents Pipenv from generating comprehensive lock files that include hashes for all platforms. This creates issues when:

  • Lock files are generated on one platform but used on another
  • Cross-platform deployments require packages for different architectures
  • Complete hash verification is needed for security across all supported platforms

Solution

This patch adds an ignore_compatibility parameter to both LinkEvaluator and PackageFinder classes that:

  1. Bypasses binary format restrictions - Allows wheels even when "binary" is not in accepted formats
  2. Ignores wheel platform tags - Includes wheels regardless of platform compatibility
  3. Skips Python version checks - Includes packages that don't match the current Python version
  4. Handles unsupported wheels gracefully - Prevents crashes when sorting incompatible wheels

Changes

  • Added ignore_compatibility parameter to LinkEvaluator.__init__()
  • Modified evaluate_link() to conditionally skip compatibility checks
  • Updated _sort_key() to handle unsupported wheels without raising exceptions
  • Added ignore_compatibility parameter to PackageFinder.__init__()
  • Created formal patch file for vendoring process

Impact

This enables Pipenv to generate lock files with comprehensive hash coverage across all platforms while maintaining backward compatibility (defaults to False).

Files changed:

  • pipenv/patched/pip/_internal/index/package_finder.py
  • tasks/vendoring/patches/patched/pip_finder_ignore_compatability.patch

The checklist

  • Associated issue
  • A news fragment in the news/ directory to describe this fix with the extension .bugfix.rst, .feature.rst, .behavior.rst, .doc.rst. .vendor.rst. or .trivial.rst (this will appear in the release changelog). Use semantic line breaks and name the file after the issue number or the PR #.

@matteius matteius changed the title Restore the missing ignore compatibility finder patch Add back ignore_compatibility option to pip package finder for comprehensive lock file generation Jun 26, 2025
Copy link
Contributor

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR restores the lost ignore_compatibility flag in Pipenv’s vendored Pip LinkEvaluator and PackageFinder to allow lock-file generation across all platforms.

  • Adds ignore_compatibility parameter to LinkEvaluator and skips compatibility checks when enabled
  • Extends PackageFinder with the same flag, updates sorting to handle unsupported wheels, and propagates the flag to link evaluation
  • Provides a vendoring patch file and adds a news fragment

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File Description
tasks/vendoring/patches/patched/pip_finder_ignore_compatability.patch Vendoring patch adding ignore_compatibility logic
pipenv/patched/pip/_internal/index/package_finder.py Implements ignore_compatibility in evaluator and sorter
news/6426.bugfix.rst News entry for restored compatibility option
Comments suppressed due to low confidence (1)

tasks/vendoring/patches/patched/pip_finder_ignore_compatability.patch:1

  • The filename pip_finder_ignore_compatability.patch has a typo in "compatability". Rename it to pip_finder_ignore_compatibility.patch to prevent vendoring/apply-script failures.
--- a/pipenv/patched/pip/_internal/index/package_finder.py

target_python: TargetPython,
allow_yanked: bool,
ignore_requires_python: Optional[bool] = None,
ignore_compatibility: Optional[bool] = None,
Copy link
Preview

Copilot AI Jun 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] For consistency with how ignore_requires_python is handled, initialize ignore_compatibility to False when it's None (e.g., if ignore_compatibility is None: ignore_compatibility = False). This avoids relying on truthiness of None.

Copilot uses AI. Check for mistakes.

project_name=self._project_name,
)

return sorted(filtered_applicable_candidates, key=self._sort_key)
Copy link
Preview

Copilot AI Jun 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new ignore_compatibility parameter on _sort_key is never passed when sorting (sorted(..., key=self._sort_key)), so it always uses the default True. Update the sort call to key=lambda c: self._sort_key(c, self._ignore_compatibility) to honor the instance flag.

Suggested change
return sorted(filtered_applicable_candidates, key=self._sort_key)
return sorted(filtered_applicable_candidates, key=lambda c: self._sort_key(c, self._ignore_compatibility))

Copilot uses AI. Check for mistakes.

@matteius matteius merged commit c3774cc into main Jun 26, 2025
18 of 19 checks passed
@matteius matteius deleted the restore-ignore-compat-finder branch June 26, 2025 19:08
github-merge-queue bot pushed a commit to NomicFoundation/slang that referenced this pull request Aug 7, 2025
Bumps [pipenv](https://github.com/pypa/pipenv) from 2024.4.1 to
2025.0.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/pipenv/releases">pipenv's
releases</a>.</em></p>
<blockquote>
<h2>Release v2025.0.4</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix editable installation from relative paths on Windows by <a
href="https://github.com/stewartmiles"><code>@​stewartmiles</code></a>
in <a
href="https://redirect.github.com/pypa/pipenv/pull/6416">pypa/pipenv#6416</a></li>
<li>chore: remove tomli from vendor by <a
href="https://github.com/oz123"><code>@​oz123</code></a> in <a
href="https://redirect.github.com/pypa/pipenv/pull/6417">pypa/pipenv#6417</a></li>
<li>Bump urllib3 from 2.4.0 to 2.5.0 in /examples by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/pypa/pipenv/pull/6424">pypa/pipenv#6424</a></li>
<li>Bump requests from 2.32.3 to 2.32.4 in /examples by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/pypa/pipenv/pull/6427">pypa/pipenv#6427</a></li>
<li>Add back ignore_compatibility option to pip package finder for
comprehensive lock file generation by <a
href="https://github.com/matteius"><code>@​matteius</code></a> in <a
href="https://redirect.github.com/pypa/pipenv/pull/6426">pypa/pipenv#6426</a></li>
<li>Bugfix: Make sure ensure_python() installs Python when conditions
are met by <a href="https://github.com/EpiX-1"><code>@​EpiX-1</code></a>
in <a
href="https://redirect.github.com/pypa/pipenv/pull/6425">pypa/pipenv#6425</a></li>
<li>Performance Optimization: Resolver, Benchmarking &amp; Batch
Operations by <a
href="https://github.com/matteius"><code>@​matteius</code></a> in <a
href="https://redirect.github.com/pypa/pipenv/pull/6419">pypa/pipenv#6419</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/EpiX-1"><code>@​EpiX-1</code></a> made
their first contribution in <a
href="https://redirect.github.com/pypa/pipenv/pull/6425">pypa/pipenv#6425</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/pipenv/compare/v2025.0.3...v2025.0.4">https://github.com/pypa/pipenv/compare/v2025.0.3...v2025.0.4</a></p>
<h2>Release v2025.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix release notes generation by <a
href="https://github.com/matteius"><code>@​matteius</code></a> in <a
href="https://redirect.github.com/pypa/pipenv/pull/6399">pypa/pipenv#6399</a></li>
<li>Vendor in pip 25.1.1 by <a
href="https://github.com/matteius"><code>@​matteius</code></a> in <a
href="https://redirect.github.com/pypa/pipenv/pull/6400">pypa/pipenv#6400</a></li>
<li>vendor: remove dparse and ruamel by <a
href="https://github.com/oz123"><code>@​oz123</code></a> in <a
href="https://redirect.github.com/pypa/pipenv/pull/6407">pypa/pipenv#6407</a></li>
<li>Fix pypi-server startup (it now requires <code>--welcome</code>). by
<a
href="https://github.com/stewartmiles"><code>@​stewartmiles</code></a>
in <a
href="https://redirect.github.com/pypa/pipenv/pull/6410">pypa/pipenv#6410</a></li>
<li>Rewrite docs Claude AI prompt for more cohesive technical voice and
expanded examples by <a
href="https://github.com/matteius"><code>@​matteius</code></a> in <a
href="https://redirect.github.com/pypa/pipenv/pull/6379">pypa/pipenv#6379</a></li>
<li>Apply variant of fix for wrong cononical name in Pipfile. by <a
href="https://github.com/matteius"><code>@​matteius</code></a> in <a
href="https://redirect.github.com/pypa/pipenv/pull/6413">pypa/pipenv#6413</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/stewartmiles"><code>@​stewartmiles</code></a>
made their first contribution in <a
href="https://redirect.github.com/pypa/pipenv/pull/6410">pypa/pipenv#6410</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/pipenv/compare/v2025.0.2...v2025.0.3">https://github.com/pypa/pipenv/compare/v2025.0.2...v2025.0.3</a></p>
<h2>Release v2025.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Cleanup unused dependencies by <a
href="https://github.com/matteius"><code>@​matteius</code></a> in <a
href="https://redirect.github.com/pypa/pipenv/pull/6386">pypa/pipenv#6386</a></li>
<li>Fix for UnboundLocalError in ensure_python
SESSION_IS_INTERACTIVE=False by <a
href="https://github.com/matteius"><code>@​matteius</code></a> in <a
href="https://redirect.github.com/pypa/pipenv/pull/6389">pypa/pipenv#6389</a></li>
<li>Fix changelog generation during release. by <a
href="https://github.com/matteius"><code>@​matteius</code></a> in <a
href="https://redirect.github.com/pypa/pipenv/pull/6394">pypa/pipenv#6394</a></li>
<li>Correct check/scan command documentation by <a
href="https://github.com/kerhac"><code>@​kerhac</code></a> in <a
href="https://redirect.github.com/pypa/pipenv/pull/6398">pypa/pipenv#6398</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/kerhac"><code>@​kerhac</code></a> made
their first contribution in <a
href="https://redirect.github.com/pypa/pipenv/pull/6398">pypa/pipenv#6398</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/pipenv/compare/v2025.0.1...v2025.0.2">https://github.com/pypa/pipenv/compare/v2025.0.1...v2025.0.2</a></p>
<h2>Release v2025.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>HOTFIX import requirements by <a
href="https://github.com/matteius"><code>@​matteius</code></a> in <a
href="https://redirect.github.com/pypa/pipenv/pull/6385">pypa/pipenv#6385</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/pipenv/compare/v2025.0.0...v2025.0.1">https://github.com/pypa/pipenv/compare/v2025.0.0...v2025.0.1</a></p>
<h2>Release v2025.0.0</h2>
<h2>What's Changed</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/pipenv/blob/main/CHANGELOG.md">pipenv's
changelog</a>.</em></p>
<blockquote>
<h1>2025.0.4 (2025-07-07)</h1>
<h1>Pipenv 2025.0.4 (2025-07-07)</h1>
<h2>Bug Fixes</h2>
<ul>
<li>Significantly improved dependency resolution performance with
ResolveLib 1.2.0 optimistic backjumping, intelligent caching system, and
batch Pipfile operations. Added comprehensive benchmarking
infrastructure to prevent performance regressions. Requirements imports
are 60-80% faster for large files, complex resolutions are 10-30%
faster, and repeated operations benefit from smart caching.
<code>[#6419](pypa/pipenv#6419)
&lt;https://github.com/pypa/pipenv/issues/6419&gt;</code>_</li>
<li>Ensure the requested Python version is installed when it differs
from the one used with Pipenv.
<code>[#6425](pypa/pipenv#6425)
&lt;https://github.com/pypa/pipenv/issues/6425&gt;</code>_</li>
<li>Restored ignore compatibility finder patch to enable comprehensive
cross-platform hash collection in lock files.
<code>[#6426](pypa/pipenv#6426)
&lt;https://github.com/pypa/pipenv/issues/6426&gt;</code>_
2025.0.3 (2025-05-29)
=====================
Pipenv 2025.0.3 (2025-05-29)
============================</li>
</ul>
<h2>Vendored Libraries</h2>
<ul>
<li>Vendor in <code>pip==25.1.1</code> latest.
<code>[#6400](pypa/pipenv#6400)
&lt;https://github.com/pypa/pipenv/issues/6400&gt;</code>_
2025.0.1 (2025-05-02)
=====================
2025.0.2 2025.0.1 (2025-05-02)
==============================</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li>Cleanup unused dependencies when upgrading packages.
<code>[#6386](pypa/pipenv#6386)
&lt;https://github.com/pypa/pipenv/issues/6386&gt;</code>_</li>
<li>Fix for <code>UnboundLocalError</code> in <code>ensure_python</code>
when <code>SESSION_IS_INTERACTIVE=False</code>, using pyenv, and python
version in Pipfile not available.
<code>[#6389](pypa/pipenv#6389)
&lt;https://github.com/pypa/pipenv/issues/6389&gt;</code>_</li>
</ul>
<h1>2025.0.1 (2025-04-24)</h1>
<h1>Pipenv 2025.0.1 (2025-04-24)</h1>
<h2>Bug Fixes</h2>
<ul>
<li>Fix for broken import requirements in <code>2025.0.0</code>
<code>[#6385](pypa/pipenv#6385)
&lt;https://github.com/pypa/pipenv/issues/6385&gt;</code>_</li>
</ul>
<h1>2025.0.0 (2025-04-24)</h1>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/pipenv/commit/4e5f9a79839f0e6701422341dcdf8edebb5063eb"><code>4e5f9a7</code></a>
Release v2025.0.4</li>
<li><a
href="https://github.com/pypa/pipenv/commit/1b2eca3406a5163df49f486bddc1556b916024ee"><code>1b2eca3</code></a>
Bumped version to 2025.0.4.</li>
<li><a
href="https://github.com/pypa/pipenv/commit/25d3d98079da966e987dbe97828bab43ed3ea4d0"><code>25d3d98</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/pipenv/issues/6419">#6419</a>
from pypa/increase-resolution-depth</li>
<li><a
href="https://github.com/pypa/pipenv/commit/959ab65655876e82f5fc7a498aa19d00c83209c4"><code>959ab65</code></a>
rework test to be less problematic</li>
<li><a
href="https://github.com/pypa/pipenv/commit/e2aaef6318376f0564b19188a962a9e82efb5477"><code>e2aaef6</code></a>
rework test to be less problematic</li>
<li><a
href="https://github.com/pypa/pipenv/commit/2a8dc20c31c0c9852b5d624a4e8bfaf0a3a2e064"><code>2a8dc20</code></a>
fix ruff error</li>
<li><a
href="https://github.com/pypa/pipenv/commit/65a1089f829deea12efd46a57c69999ac03d5cd5"><code>65a1089</code></a>
try fixing flaky test</li>
<li><a
href="https://github.com/pypa/pipenv/commit/621fafa2e3546421cfbe3e3dc175c0d0b4381dcb"><code>621fafa</code></a>
Update 6425.bugfix.rst</li>
<li><a
href="https://github.com/pypa/pipenv/commit/c76efdfa724db00750ab2380a3a46480d500e741"><code>c76efdf</code></a>
Update pipenv/utils/virtualenv.py</li>
<li><a
href="https://github.com/pypa/pipenv/commit/766c1670d83088645d6b07e05b8d7631c0da7457"><code>766c167</code></a>
Add a news fragment</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/pipenv/compare/v2024.4.1...v2025.0.4">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pipenv&package-manager=pip&previous-version=2024.4.1&new-version=2025.0.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant