cyclonedx-bom version conflict while updating with pip ===>> Python Group on Slack.

[KlausDerOptiker]

Paul (Horton) registered on pypi as contact told me to reach out to the [Python Group on Slack], because he not active on this project so far...
The buggy message is while keeping my system up to date:

cyclonedx-bom 3.11.7 requires cyclonedx-python-lib<4.0.0,>=2.0.0, but you have cyclonedx-python-lib 6.4.0 which is incompatible.

[jkowalleck]

cyclonedx-bom 3.11.7 requires cyclonedx-python-lib<4.0.0,>=2.0.0, but you have cyclonedx-python-lib 6.4.0 which is incompatible.

how did you setup your environment?
what did you do to see this message? which command did you run?
could you provide a reproducible example?

[KlausDerOptiker]

Take a look to my message, it contains all necessary information! Please take a look to pypi and understand that software continues to develop. I think an an update of cyclonedx-bom 3.11.7 is necessary or the groups developing cyclonedx-bom 3.11.7 and cyclonedx-python-lib 6.4.0 need to speak with each other…

[jkowalleck]

Take a look to my message, it contains all necessary information!

I am very sorry @KlausDerOptiker , but I cannot find any. Which message? Where?
Please help clarify. :-)

[KlausDerOptiker]

See below or the topic while updating with pip… Von: Jan Kowalleck ***@***.***> Gesendet: Donnerstag, 25. Januar 2024 15:37 An: CycloneDX/cyclonedx-python ***@***.***> Cc: KlausDerOptiker ***@***.***>; Mention ***@***.***> Betreff: Re: [CycloneDX/cyclonedx-python] cyclonedx-bom version conflict while updating with pip ===>> Python Group on Slack. (Discussion #658) Take a look to my message, it contains all necessary information! I am very sorry @KlausDerOptiker <https://github.com/KlausDerOptiker> , but I cannot find any. Which message? Where? Please help clarify. :-) — Reply to this email directly, view it on GitHub <#658 (reply in thread)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/AKVWP4Q25ME2MTIOY5OHISTYQJUYVAVCNFSM6AAAAABCKUHKV6VHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4DENBVHAZDC> . You are receiving this because you were mentioned. <https://github.com/notifications/beacon/AKVWP4QIT6D2H6ZZCFNI5WTYQJUYVA5CNFSM6AAAAABCKUHKV6WGG33NNVSW45C7OR4XAZNRIRUXGY3VONZWS33OINXW23LFNZ2KUY3PNVWWK3TUL5UWJTQAPXJD2.gif> Message ID: ***@***.*** ***@***.***> >

[jkowalleck]

details are described here: #658 (comment)

[KlausDerOptiker]

Betreff: Re: [CycloneDX/cyclonedx-python] cyclonedx-bom version conflict while updating with pip ===>> Python Group on Slack.

Windows powershell: pip freeze | %{$.split('==')[0]} | %{pip install --upgrade $} runs through all, look for the newest and upgrades all.
This reproduces on all my windows 10 machines the same buggy behavior.

[jkowalleck]

pip freeze | %{$.split('==')[0]} | %{pip install --upgrade $}

so this is how you chose to upgrade each python env component individually, without having pip check for best-paths and dependencies.
I bet pip actually spit out some warnings about incompatible versions and that this process might break dependencies ...

This reproduces on all my windows 10 machines the same buggy behavior.

I do not see any "buggy behavior". In fact, pip is informing you that you have set your python env to a broken state on purpose.
You chose to upgrade cyclonedx-python-lib to >= 4, despite that is incompatible to one of your installed other python packages.
Please understand how dependency constraints work.

[KlausDerOptiker]

what I mean with "buggy behavior" is, that the the program requesting that lib needs to be updated to be compatible with the newest version. It bothers me if there are artefacts left not up to date.
How do I know if there is a door in for an attact...? if I use it?
The most reasons for updates is not to add new functions, it is most to optimize and harden the software.

So, I ask the programmers to please update their program cyclonedx-bom to get rid of the "buggy behavior"--- that's all folks!

Thank you for your patiens jkwowalleck, I think minimum you do understand now what I mean.