Fix constraints file parsing for URL requirements. (#3090)

Fixes #3089

Author: jsirois

CHANGES.md

@@ -1,5 +1,13 @@
 # Release Notes
 
+## 2.86.1
+
+This release fixes a bug in constraints file requirement parsing. Previously, Pex tried to validate
+constraints beyond its own needs, anticipating Pip's needs, leading to a failure to handle direct
+reference URL requirements, including VCS requirements.
+
+* Fix constraints file parsing for URL requirements. (#3090)
+
 ## 2.86.0
 
 This release adds support for Linux PEX scies installing themselves with a desktop entry on first

pex/requirements.py

@@ -778,12 +778,17 @@ def parse_requirements(
                 logical_line, basepath=os.path.dirname(source.origin) if source.is_file else None
             )
             if source.is_constraints:
-                if not isinstance(requirement, PyPIRequirement) or requirement.requirement.extras:
+                if (
+                    not isinstance(requirement, (PyPIRequirement, URLRequirement, VCSRequirement))
+                    or requirement.requirement.extras
+                ):
                     raise ParseError(
                         logical_line,
-                        "Constraint files do not support VCS, URL or local project requirements"
-                        "and they do not support requirements with extras. Search for 'We are also "
-                        "changing our support for Constraints Files' here: "
+                        "Constraint files do not support local project requirements and they "
+                        "do not support requirements with extras; see:"
+                        "https://pip.pypa.io/en/stable/user_guide/#constraints-files. If you are "
+                        "using --pip-version vendored or a very old --pip-version, search for 'We "
+                        "are also changing our support for Constraints Files' here: "
                         "https://pip.pypa.io/en/stable/user_guide/"
                         "#changes-to-the-pip-dependency-resolver-in-20-3-2020.",
                     )

pex/version.py

@@ -1,4 +1,4 @@
 # Copyright 2015 Pex project contributors.
 # Licensed under the Apache License, Version 2.0 (see LICENSE).
 
-__version__ = "2.86.0"
+__version__ = "2.86.1"

tests/integration/test_issue_3089.py

@@ -0,0 +1,47 @@
+# Copyright 2026 Pex project contributors.
+# Licensed under the Apache License, Version 2.0 (see LICENSE).
+
+from __future__ import absolute_import, print_function
+
+from pex.artifact_url import VCS, ArtifactURL
+from pex.dist_metadata import Requirement
+from pex.pep_440 import Version
+from pex.pep_503 import ProjectName
+from pex.resolve.locked_resolve import VCSArtifact
+from pex.resolve.lockfile import json_codec
+from testing.cli import run_pex3
+from testing.pytest_utils.tmp import Tempdir
+
+
+def test_url_requirement_constraints(tmpdir):
+    # type: (Tempdir) -> None
+
+    lock_file = tmpdir.join("lock.json")
+
+    with open(tmpdir.join("constraint.txt"), "w") as fp:
+        print("cowsay @ git+https://github.com/VaasuDevanS/cowsay-python@v5.0", file=fp)
+
+    run_pex3(
+        "lock", "create", "--constraints", fp.name, "cowsay", "--indent", "2", "-o", lock_file
+    ).assert_success()
+
+    lock = json_codec.load(lock_file)
+    assert [Requirement.parse("cowsay")] == list(lock.requirements)
+    assert len(lock.locked_resolves) == 1
+
+    locked_resolve = lock.locked_resolves[0]
+    locked_requirements_by_name = {
+        locked_requirement.pin.project_name: locked_requirement
+        for locked_requirement in locked_resolve.locked_requirements
+    }
+    locked_requirement = locked_requirements_by_name.pop(ProjectName("cowsay"))
+    assert not locked_requirements_by_name
+
+    assert Version("5") == locked_requirement.pin.version
+    assert isinstance(locked_requirement.artifact, VCSArtifact)
+    assert locked_requirement.artifact.vcs is VCS.Git
+    assert "v5.0" == locked_requirement.artifact.requested_revision
+    assert (
+        ArtifactURL.parse("git+https://github.com/VaasuDevanS/cowsay-python@v5.0")
+        == locked_requirement.artifact.url
+    )

tests/test_requirements.py

@@ -1,7 +1,7 @@
 # Copyright 2020 Pex project contributors.
 # Licensed under the Apache License, Version 2.0 (see LICENSE).
 
-from __future__ import absolute_import
+from __future__ import absolute_import, print_function
 
 import os
 from textwrap import dedent
@@ -612,3 +612,19 @@ def test_parse_requirements_from_url_no_fetcher():
         "Problem resolving requirements file: The source is a url but no fetcher was supplied to "
         "resolve its contents with.".format(EXAMPLE_PYTHON_REQUIREMENTS_URL)
     ) == str(exec_info.value)
+
+
+def test_url_requirement_constraints_issue_3089(tmpdir):
+    # type: (Tempdir) -> None
+
+    with open(tmpdir.join("constraint.txt"), "w") as fp:
+        print("cowsay @ git+https://github.com/VaasuDevanS/cowsay-python@v5.0", file=fp)
+
+    assert [
+        Constraint(
+            line=DUMMY_LINE,
+            requirement=Requirement.parse(
+                "cowsay @ git+https://github.com/VaasuDevanS/cowsay-python@v5.0"
+            ),
+        )
+    ] == normalize_results(parse_requirement_file(fp.name, is_constraints=True))