Pip Package dependency overriding specified version in requirements.txt

I got a Flask App and installed the dependencies out of the requirements.txt. I got the following error when running my App:

ImportError: cannot import name 'soft_unicode' from 'markupsafe'

MarkupSafe is a package required by Jinja2 which in turn is required by Flask.

I soon found out that downgrading MarkupSafe from version 2.1.1 to 2.0.1 fixes the issue, and I adapted my requirements.txt:

MarkupSafe==2.0.1 # Newer version causes errors
rpi-ws281x==4.3.3
Flask==2.0.3
Flask-SocketIO==5.1.1

But after installing, I find out that the Jinja2 installing process overrides my specified version of MarkupSafe and I again end up with version 2.1.1. I know about the force reinstall option of pip but wondered if there is a better approach.

Thanks in advance!

Answer

Use pipenv: https://pipenv.pypa.io/.

At least some time ago, Pip used to have some flaws in solving multiple packages dependencies. I now saw an update note on their documentation that seems to tackle the problem; haven’t tested yet. Pipenv would solve the dependencies graph just fine. That was one of the reason I started using Pipenv.

Please, have a look at the following pages:

• https://realpython.com/pipenv-guide/ (pipenv; your scenario)
• https://pip.pypa.io/en/stable/topics/dependency-resolution/#backtracking (pip; recent update)
• https://stackoverflow.com/a/55826767/687896 (similar question)