Re: [D] pypi installation vs. dependencies [superset]

["FrancescoCastaldi (via GitHub)" <gi...@apache.org>]

GitHub user FrancescoCastaldi added a comment to the discussion: pypi installation vs. dependencies

Your observation is correct: `pyproject.toml` and `setup.py` in Apache Superset specify loose dependency ranges to allow flexibility, but running an unconstrained `pip install apache-superset` will resolve recent transient releases of sub-dependencies (like `cachetools`, `rich`, or `flask-sqlalchemy`) that break runtime contracts.

To achieve a reliable, deterministic PyPI installation identical to official release containers, you must use Superset's official **constraints file**.

### The Supported PyPI Installation Method

When installing from PyPI, supply the version-pinned constraints file maintained in the repository for that exact release tag:

```bash
# Set your target version
export SUPERSET_VERSION=6.1.0

# Install using the release constraint file
pip install apache-superset==${SUPERSET_VERSION} \
  -c https://raw.githubusercontent.com/apache/superset/${SUPERSET_VERSION}/requirements/base.txt
```

### Why this is necessary
- Superset relies on strict pins for core packages (such as `Flask-AppBuilder`, `Werkzeug`, `SQLAlchemy`, and `Flask-Caching`) because upstream patch releases frequently introduce breaking changes in internal extension points.
- The `requirements/base.txt` file in the GitHub tag contains the fully resolved, tested dependency lock tree used to build the official Docker images.

### If you use `uv pip compile`
If you manage your environment with `uv`, do not compile from `pyproject.toml` directly. Instead, compile against the official `requirements/base.txt`:
```bash
uv pip install -r https://raw.githubusercontent.com/apache/superset/6.1.0/requirements/base.txt
uv pip install apache-superset==6.1.0 --no-deps
```
This avoids any manual dependency patching while making it easy to install custom database drivers alongside Superset.


GitHub link: https://github.com/apache/superset/discussions/41902#discussioncomment-19164783

----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org