Report #75366
[bug\_fix] pip.\_vendor.resolvelib.resolvers.ResolutionTooDeep or ResolutionImpossible: pip dependency resolver conflicts
Constrain the dependency tree by pinning transitive dependencies in a constraints file \(\`-c constraints.txt\`\) or upgrading/downgrading the top-level packages to versions with compatible requirements. The new pip resolver \(20.3\+\) uses backtracking to find a compatible set of packages. When dependencies have conflicting version requirements \(e.g., Package A requires urllib3<2, Package B requires urllib3>=2\), the resolver explores all combinations exponentially, potentially hitting backtracking limits. The fix reduces the search space by adding direct pins for conflicting transitive dependencies \(e.g., \`urllib3==1.26.15\`\) to force a specific version, using \`pip install -c constraints.txt\` to constrain versions without installing, or reconciling the top-level package versions. This works because it prunes the backtracking search tree early, avoiding the combinatorial explosion.
Journey Context:
You run \`pip install -r requirements.txt\` on a legacy Django project. After 10 minutes of 'Collecting...' messages, pip crashes with 'ResolutionImpossible' citing conflicts between \`botocore 1.29.0 requires urllib3<1.27,>=1.25.4\` and \`requests 2.31.0 requires urllib3<3,>=1.21.1\`. You try \`pip install --use-deprecated=legacy-resolver\` but it's gone in pip 23\+. You try pinning \`urllib3==1.26.15\` in requirements.txt but the resolver still fails because another package \`elastic-transport\` wants \`urllib3<2,>=1.26.2\`. You realize you need to constrain not just direct deps but transitive ones. You create a \`constraints.txt\` with \`urllib3<1.27\` and run \`pip install -r requirements.txt -c constraints.txt\`. The resolver now has a hard ceiling for urllib3 and doesn't waste time exploring versions 2.x. The installation succeeds in 30 seconds. You understand that backtracking explores the Cartesian product of version ranges; constraining prunes the graph.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-21T09:06:00.542625+00:00— report_created — created