Problem: pip does not correctly resolve dependency versions from pypi packages in one case. Specifically, when installing only moto and idna together - pip misinterprets the upper end of the version range. In this case, the dependency requirements are pinned in setup.py, rather than requirements.txt.

see public repo for demo code: https://github.com/surfaceowl/pip-20.2.2-feedback

Observations -- default resolver reports two errors; while 2020-resolver reports only one (idna) -- idna fails with both resolvers, because git reports moto requires idna<2.9,>=2.5,... but the source actually idna<3,>=2.5... the requirements file has idna==2.10 ...which is < 3.... -- moto github repo (https://github.com/spulec/moto/blob/master/setup.py) lists "idna<3,>=2.5", -- it is not clear if this is a problem with pip, or a problem with the way data is being fed to pip in the package metadata.

steps to recreate 1- setup current environment: ubuntu20.04; python3.8.3; running in virtualenv named venv created by: python3 -m virtualenv venv

2- pip list: results of pip list Package Version

---

pip 20.2.2 setuptools 49.6.0 wheel 0.35.1

** remember convenience script to pip uninstall all pip install packages: pip freeze | xargs pip uninstall -y

3- create requirements.txt with only two pinned entries: idna==2.10 moto==1.3.14

4-install requirements.txt with default resolver python3 -m pip install -r requirements.txt

ERROR: After October 2020 you may experience errors when installing or updating packages. This is because pip will change the way that it resolves dependency conflicts.

We recommend you use --use-feature=2020-resolver to test your packages with the new resolver before it becomes the default.

python-jose 3.2.0 requires ecdsa<0.15, but you'll have ecdsa 0.15 which is incompatible.
moto 1.3.14 requires idna<2.9,>=2.5, but you'll have idna 2.10 which is incompatible.

5- install requirements.txt with --use-feature=202-resolver python3 -m pip install -r requirements.txt --use-feature=202-resolver

ERROR: Cannot install idna==2.10 and moto 1.3.14 because these package versions have conflicting dependencies.

The conflict is caused by:
    The user requested idna==2.10
    moto 1.3.14 depends on idna<2.9 and >=2.5

To fix this you could try to:
1. loosen the range of package versions you've specified
2. remove package versions to allow pip attempt to solve the dependency conflict

ERROR: ResolutionImpossible: for help visit https://pip.pypa.io/en/latest/user_guide/#fixing-conflicting-dependencies

6- check setup that should work correctly use backup requirements.txt file with lower version of idna (below <2.9 as reported by pip errors above) add new requirement to fix ecdsa dependency error with default resolver ecdsa==0.14 idna==2.8 moto==1.3.14

run pip cleanup script: pip freeze | xargs pip uninstall -y run python3 -m pip install -r requirements2.8.txt (works correctly with both resolvers)