Issue description
Given the following Pipfile & Pipfile.lock: https://github.com/dependabot/smoke-tests/tree/51f9d91e764828b6ee20d5bf79779c52564c4ac3/pipenv.
Running pipenv upgrade results in the following diff:
diff --git a/pipenv/Pipfile b/pipenv/Pipfile
index 6d1af4e..6fd4aa4 100644
--- a/pipenv/Pipfile
+++ b/pipenv/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
name = "pypi"
[packages]
-django = "==3.2.10"
+django = "==4.2.7"
numpy = "1.23.0"
[dev-packages]
diff --git a/pipenv/Pipfile.lock b/pipenv/Pipfile.lock
index 537d422..6bf2b73 100644
--- a/pipenv/Pipfile.lock
+++ b/pipenv/Pipfile.lock
@@ -1,7 +1,7 @@
{
"_meta": {
"hash": {
- "sha256": "92ac8dfe0706d68c6ec85e7b3f66e943af05ed6ee3cebf54ea7a4a07472c2114"
+ "sha256": "f46757b1eca5b4691f0a06b5d8e7cbed4354909d40a7e0fe33eab868098d8c0d"
},
"pipfile-spec": 6,
"requires": {
@@ -26,11 +26,12 @@
},
"django": {
"hashes": [
- "sha256:074e8818b4b40acdc2369e67dcd6555d558329785408dcd25340ee98f1f1d5c4",
- "sha256:df6f5eb3c797b27c096d61494507b7634526d4ce8d7c8ca1e57a4fb19c0738a3"
+ "sha256:8e0f1c2c2786b5c0e39fe1afce24c926040fad47c8ea8ad30aaf1188df29fc41",
+ "sha256:e1d37c51ad26186de355cbcec16613ebdabfa9689bbade9c538835205a8abbe9"
],
"index": "pypi",
- "version": "==3.2.10"
+ "markers": "python_version >= '3.8'",
+ "version": "==4.2.7"
},
"numpy": {
"hashes": [This looks pretty great, but I think pytz is no longer a dependency after upgrading to 4.2.7, so I would expect it to be removed.
I noticed this when migrating Dependabot to use pipenv upgrade instead of what we use now, pipenv lock.
pipenv lock has undesired effects for us (in this case, it upgrades unrelated numpy dependency too), that's why pipenv upgrade is perfect for our use case. But pipenv lock does do cleanup unused dependencies:
diff --git a/pipenv/Pipfile.lock b/pipenv/Pipfile.lock
index 537d422..eb22900 100644
--- a/pipenv/Pipfile.lock
+++ b/pipenv/Pipfile.lock
@@ -1,7 +1,7 @@
{
"_meta": {
"hash": {
- "sha256": "92ac8dfe0706d68c6ec85e7b3f66e943af05ed6ee3cebf54ea7a4a07472c2114"
+ "sha256": "f46757b1eca5b4691f0a06b5d8e7cbed4354909d40a7e0fe33eab868098d8c0d"
},
"pipfile-spec": 6,
"requires": {
@@ -26,49 +26,41 @@
},
"django": {
"hashes": [
- "sha256:074e8818b4b40acdc2369e67dcd6555d558329785408dcd25340ee98f1f1d5c4",
- "sha256:df6f5eb3c797b27c096d61494507b7634526d4ce8d7c8ca1e57a4fb19c0738a3"
+ "sha256:8e0f1c2c2786b5c0e39fe1afce24c926040fad47c8ea8ad30aaf1188df29fc41",
+ "sha256:e1d37c51ad26186de355cbcec16613ebdabfa9689bbade9c538835205a8abbe9"
],
"index": "pypi",
- "version": "==3.2.10"
+ "markers": "python_version >= '3.8'",
+ "version": "==4.2.7"
},
"numpy": {
"hashes": [
- "sha256:0d60fbae8e0019865fc4784745814cff1c421df5afee233db6d88ab4f14655a2",
- "sha256:1a1329e26f46230bf77b02cc19e900db9b52f398d6722ca853349a782d4cff55",
- "sha256:1b9735c27cea5d995496f46a8b1cd7b408b3f34b6d50459d9ac8fe3a20cc17bf",
- "sha256:2792d23d62ec51e50ce4d4b7d73de8f67a2fd3ea710dcbc8563a51a03fb07b01",
- "sha256:3e0746410e73384e70d286f93abf2520035250aad8c5714240b0492a7302fdca",
- "sha256:4c3abc71e8b6edba80a01a52e66d83c5d14433cbcd26a40c329ec7ed09f37901",
- "sha256:5883c06bb92f2e6c8181df7b39971a5fb436288db58b5a1c3967702d4278691d",
- "sha256:5c97325a0ba6f9d041feb9390924614b60b99209a71a69c876f71052521d42a4",
- "sha256:60e7f0f7f6d0eee8364b9a6304c2845b9c491ac706048c7e8cf47b83123b8dbf",
- "sha256:76b4115d42a7dfc5d485d358728cdd8719be33cc5ec6ec08632a5d6fca2ed380",
- "sha256:7dc869c0c75988e1c693d0e2d5b26034644399dd929bc049db55395b1379e044",
- "sha256:834b386f2b8210dca38c71a6e0f4fd6922f7d3fcff935dbe3a570945acb1b545",
- "sha256:8b77775f4b7df768967a7c8b3567e309f617dd5e99aeb886fa14dc1a0791141f",
- "sha256:90319e4f002795ccfc9050110bbbaa16c944b1c37c0baeea43c5fb881693ae1f",
- "sha256:b79e513d7aac42ae918db3ad1341a015488530d0bb2a6abcbdd10a3a829ccfd3",
- "sha256:bb33d5a1cf360304754913a350edda36d5b8c5331a8237268c48f91253c3a364",
- "sha256:bec1e7213c7cb00d67093247f8c4db156fd03075f49876957dca4711306d39c9",
- "sha256:c5462d19336db4560041517dbb7759c21d181a67cb01b36ca109b2ae37d32418",
- "sha256:c5652ea24d33585ea39eb6a6a15dac87a1206a692719ff45d53c5282e66d4a8f",
- "sha256:d7806500e4f5bdd04095e849265e55de20d8cc4b661b038957354327f6d9b295",
- "sha256:db3ccc4e37a6873045580d413fe79b68e47a681af8db2e046f1dacfa11f86eb3",
- "sha256:dfe4a913e29b418d096e696ddd422d8a5d13ffba4ea91f9f60440a3b759b0187",
- "sha256:eb942bfb6f84df5ce05dbf4b46673ffed0d3da59f13635ea9b926af3deb76926",
- "sha256:f08f2e037bba04e707eebf4bc934f1972a315c883a9e0ebfa8a7756eabf9e357",
- "sha256:fd608e19c8d7c55021dffd43bfe5492fab8cc105cc8986f813f8c3c048b38760"
+ "sha256:092f5e6025813e64ad6d1b52b519165d08c730d099c114a9247c9bb635a2a450",
+ "sha256:196cd074c3f97c4121601790955f915187736f9cf458d3ee1f1b46aff2b1ade0",
+ "sha256:1c29b44905af288b3919803aceb6ec7fec77406d8b08aaa2e8b9e63d0fe2f160",
+ "sha256:2b2da66582f3a69c8ce25ed7921dcd8010d05e59ac8d89d126a299be60421171",
+ "sha256:5043bcd71fcc458dfb8a0fc5509bbc979da0131b9d08e3d5f50fb0bbb36f169a",
+ "sha256:58bfd40eb478f54ff7a5710dd61c8097e169bc36cc68333d00a9bcd8def53b38",
+ "sha256:79a506cacf2be3a74ead5467aee97b81fca00c9c4c8b3ba16dbab488cd99ba10",
+ "sha256:94b170b4fa0168cd6be4becf37cb5b127bd12a795123984385b8cd4aca9857e5",
+ "sha256:97a76604d9b0e79f59baeca16593c711fddb44936e40310f78bfef79ee9a835f",
+ "sha256:98e8e0d8d69ff4d3fa63e6c61e8cfe2d03c29b16b58dbef1f9baa175bbed7860",
+ "sha256:ac86f407873b952679f5f9e6c0612687e51547af0e14ddea1eedfcb22466babd",
+ "sha256:ae8adff4172692ce56233db04b7ce5792186f179c415c37d539c25de7298d25d",
+ "sha256:bd3fa4fe2e38533d5336e1272fc4e765cabbbde144309ccee8675509d5cd7b05",
+ "sha256:d0d2094e8f4d760500394d77b383a1b06d3663e8892cdf5df3c592f55f3bff66",
+ "sha256:d54b3b828d618a19779a84c3ad952e96e2c2311b16384e973e671aa5be1f6187",
+ "sha256:d6ca8dabe696c2785d0c8c9b0d8a9b6e5fdbe4f922bde70d57fa1a2848134f95",
+ "sha256:d8cc87bed09de55477dba9da370c1679bd534df9baa171dd01accbb09687dac3",
+ "sha256:f0f18804df7370571fb65db9b98bf1378172bd4e962482b857e612d1fec0f53e",
+ "sha256:f1d88ef79e0a7fa631bb2c3dda1ea46b32b1fe614e10fedd611d3d5398447f2f",
+ "sha256:f9c3fc2adf67762c9fe1849c859942d23f8d3e0bee7b5ed3d4a9c3eeb50a2f07",
+ "sha256:fc431493df245f3c627c0c05c2bd134535e7929dbe2e602b80e42bf52ff760bc",
+ "sha256:fe8b9683eb26d2c4d5db32cd29b38fdcf8381324ab48313b5b69088e0e355379"
],
"index": "pypi",
- "version": "==1.25.2"
- },
- "pytz": {
- "hashes": [
- "sha256:1d8ce29db189191fb55338ee6d0387d82ab59f3d00eac103412d64e0ebd0c588",
- "sha256:a151b3abb88eda1d4e34a9814df37de2a80e301e68ba0fd856fb9b46bfbbbffb"
- ],
- "version": "==2023.3"
+ "markers": "python_version >= '3.8'",
+ "version": "==1.23.0"
},
"sqlparse": {
"hashes": [Expected result
I expect Django to be upgraded to 4.2.7 and pytz to be removed from the lockfile because of no longer being a dependency.
Actual result
Django is properly upgraded, but pytz stays without anything depending on it.
Steps to replicate
Clone https://github.com/dependabot/smoke-tests, switch to pipenv folder, and run pipenv upgrade django==4.2.7.
Issue description
Given the following Pipfile & Pipfile.lock: https://github.com/dependabot/smoke-tests/tree/51f9d91e764828b6ee20d5bf79779c52564c4ac3/pipenv.
Running
pipenv upgraderesults in the following diff:This looks pretty great, but I think
pytzis no longer a dependency after upgrading to 4.2.7, so I would expect it to be removed.I noticed this when migrating Dependabot to use
pipenv upgradeinstead of what we use now,pipenv lock.pipenv lockhas undesired effects for us (in this case, it upgrades unrelated numpy dependency too), that's whypipenv upgradeis perfect for our use case. Butpipenv lockdoes do cleanup unused dependencies:Expected result
I expect Django to be upgraded to 4.2.7 and pytz to be removed from the lockfile because of no longer being a dependency.
Actual result
Django is properly upgraded, but pytz stays without anything depending on it.
Steps to replicate
Clone https://github.com/dependabot/smoke-tests, switch to pipenv folder, and run
pipenv upgrade django==4.2.7.