[question] Dependency tree with version range

[araffin]

What is your question?

Hello,

Is there currently a way to create a dependency tree of an installed package including version ranges/specifiers?

The idea would be to have something à la pipdeptree, which is pretty useful when debugging conflicts/errors with versions:

pipdeptree -p wandb -d 1:

wandb==0.19.4
├── click [required: >=7.1,!=8.0.0, installed: 8.1.8]
├── docker-pycreds [required: >=0.4.0, installed: 0.4.0]
...
├── requests [required: >=2.0.0,<3, installed: 2.32.3]
├── sentry-sdk [required: >=2.0.0, installed: 2.20.0]
├── setproctitle [required: Any, installed: 1.3.4]
├── setuptools [required: Any, installed: 75.8.0]
└── typing_extensions [required: >=4.4,<5, installed: 4.12.2]

or with uv pip tree --package wandb --depth 1 --show-version-specifiers:

wandb v0.19.4
├── click v8.1.8 [required: >=7.1, !=8.0.0]
├── docker-pycreds v0.4.0 [required: >=0.4.0]
...
├── requests v2.32.3 [required: >=2.0.0, <3]
├── sentry-sdk v2.20.0 [required: >=2.0.0]
├── setproctitle v1.3.4 [required: *]
├── setuptools v75.8.0 [required: *]
└── typing-extensions v4.12.2 [required: >=4.4, <5]

Currently, I'm only able to display a dependency tree (by parsing conan json output) with fixed version which are in the conan cache, for instance:

Dependency tree for wandb/0.19.3@pypi/stable
└── wandb/0.19.3@pypi/stable
    ├── docker-pycreds/0.4.0@pypi/stable
     ...
    ├── eval-type-backport/0.2.2@pypi/stable
    ├── protobuf/5.29.3@pypi/stable
    ├── pydantic/2.9.2@pypi/stable
    ├── sentry-sdk/2.20.0@pypi/stable
    └── setproctitle/1.3.3@pypi/stable

But i didn't find a way to easily retrieve version ranges so far...

EDIT: it seems that conan provides resolved_ranges in the json but only for the top package, not for the dependencies of dependencies.

Have you read the CONTRIBUTING guide?

• I've read the CONTRIBUTING guide

[memsharded]

Hi @araffin

Thanks for your question.

I am not sure I understand the intention or the problem to solve.

Python environments are "flat" they don't contain different versions of the same dependency in the same environment.
But the Conan cache does. And the same version of the same package can work simultenously with different versions of its dependencies, as long as the package types imply binary compatibility and identity. For example you can have a single package binary for boost/1.0 to use different versions zlib/1.3.1, zlib/1.3.2 of its dependency, with exactly the same boost package if both are static libraries.

But you can at any time resolve the dependencies for any given package, with conan install --requires=pkg/version or conan graph info, and that will report the resolved ranges for that specific package subgraph.

[araffin]

Let me try to be clearer. In our institute, it happens often that there is some conflict or that version ranges are wrongly defined (too loose for instance).

To debug things faster, i have a script that parses conan graph info output (either json or dot graph) to identify/understand the culprit of the conflict.

Currently, to my understanding, it is only possible to retrieve the exact version chosen by conan. I would be interested in retrieving the full dependency tree of a package (both version chosen and version ranges for the full tree, not just the direct deps) when calling conan graph info.

[memsharded]

This is what I mean there is still something that I am missing.

To debug things faster, i have a script that parses conan graph info output (either json or dot graph) to identify/understand the culprit of the conflict.

Is the debug process automated? If not, why the command reported version range resolution is not enough?

To understand and debug dependency graph, the conan graph info --format=html > graph.html is very useful. For example if there is a dependency conflict it will represent that conflict graphically.