dependency conflict

[wellshs]

Pypa released new packaging library version(https://github.com/pypa/packaging/releases/tag/22.0) and legacyVersion is deleted which used in this pip-requirements-parser library.

Currently, this code doesn't work without additional library version fixing.

[tetsuo-cpp]

Just FYI, I'm also working on a PR to get pip-requirements-parser to work with packaging>=22.0.

[pombredanne]

@tetsuo-cpp @wellshs Thanks... I knew this was coming and had been altered to the issue by the packaging maintainers! This is breaking pip audit but also projects at CycloneDX and pretty much all the projects at https://github.com/nexB
@tetsuo-cpp the short term solution is IMHO to vendor the legacyversion support

[pombredanne]

@tetsuo-cpp we can chat live on https://gitter.im/aboutcode-org/discuss accessible via IRC, web, matrix.
Or on IRC #pypa

[tetsuo-cpp]

I'm going to be offline for a few hours. But I'll sign on later and see if you're around.

Is it possible to just remove support for LegacyVersion? I assume that everything that uses packages to interpret versions (such as pip) are going to drop support for this going forward so I figured it should be fine to drop this from the parser.

[pombredanne]

Is it possible to just remove support for LegacyVersion? I assume that everything that uses packages to interpret versions (such as pip) are going to drop support for this going forward so I figured it should be fine to drop this from the parser.

It could be possible, but this would make fail requirements parsing at scale for all the legacy stuff out there. This lib is supposed and designed to parse all requirement files ever published for the whole PyPI history and beyond.

We should have a way to skip legacy though

[pombredanne]

@tetsuo-cpp do you have something/some WIP to push in a branch?
Otherwise I am pushing something myself ASAP.

[tetsuo-cpp]

I do have something but it just removes references to 'LegacyVersion' and updates tests which isn't what you had in mind. Sure, go ahead!

[pombredanne]

See #3 for a pending fix.
I vendored (with git history) the LegacyVersion

[pombredanne]

There are some tests that fail... so short term, let me pin an upper version in the setup.cfg

[pombredanne]

@wellshs @tetsuo-cpp I pushed a v32.0 to PyPI.... can you test this in your context?
Thanks!

[tetsuo-cpp]

@pombredanne Thanks! v32.0 works fine for pip-audit.

Would you like me to test against #3 too?

[pombredanne]

@tetsuo-cpp re: testing #3
this would be great!
There are some tests that I am still trying to fix though... I reckon that I combined here the tests suite of pip plus all requirements parsers known to man.... some may be a bit overkill or off broadway.