Report #14541
[bug\_fix] pip dependency resolver backtracking timeout or ResolutionImpossible
Pin dependency versions in requirements.txt with \`package==version\` constraints or use \`pip install --use-deprecated=legacy-resolver\` as a temporary workaround \(not recommended long-term\). The root cause is that pip 20.3\+ uses a strict dependency resolver that backtracks through all possible package versions to find a compatible set. When packages have overly broad or conflicting version requirements \(e.g., Package A requires \`requests>=1.0\`, Package B requires \`requests<2.0\`, but no version satisfies both\), the resolver spends exponential time backtracking through versions before failing with ResolutionImpossible. Pinning constraints reduces the search space, allowing the resolver to find a solution quickly or fail fast with a clear conflict message.
Journey Context:
You're adding a new package \`analytics-client\` to your Django project. You run \`pip install analytics-client\` and pip starts downloading dependencies. It downloads \`requests\` 2.28, then 2.27, then 2.26... it's going backwards through versions. Ten minutes later it's still downloading. You Ctrl\+C and try again with verbose mode \`pip install -v analytics-client\`. You see lines like 'INFO: pip is looking at multiple versions of requests to determine which version is compatible with other requirements'. It becomes clear that some dependency in your tree has a strict upper bound on requests, while others need newer versions. You check \`pip list\` and see you have \`requests==2.31\` already installed from another requirement. You look at the new package's setup.py and see it requires \`requests<2.30\`. Rather than letting pip backtrack forever, you decide to pin your requirements: you update your requirements.txt to specify \`requests==2.29.0\` \(which satisfies both constraints\) and \`analytics-client==1.2.3\`. You clear your pip cache and install again, and it resolves instantly.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T21:48:41.899435+00:00— report_created — created