Some dependencies are lost when compiling with pip-tools>=6.3.1

[RedRoserade]

Starting with pip-tools>=6.3.1, if I have a package A that depends on a VCS (git) package B and C via requirements.in, and B also depends on C via setup.py, then C's dependencies are not present in the compiled requirements.txt.

Environment Versions

1. OS Type: Linux
2. Python version: Python 3.10.2
3. pip version: 22.0.3
4. pip-tools version: 6.5.1

Steps to replicate

1. Define packages A, B, and C.
2. On package C, via setup.py, require pymongo and jsonschema
3. On package B, via setup.py require C (not via PEP 440 URLs, just bare C) and pymongo
4. On package A, via requirements.in, require B, C, and pymongo
5. Compile requirements.txt via A's requirements.in

A set of repositories has been prepared to demonstrate this:

• A: https://github.com/RedRoserade/pip-tools-repro-repo-a
• B: https://github.com/RedRoserade/pip-tools-repro-repo-b
• C: https://github.com/RedRoserade/pip-tools-repro-repo-c

Repository A should be taken as the root. It contains a README.md with brief instructions on how to set it up and run the test.

Expected result

• jsonschema should be present in the output requirements.txt, as it's a dependency of C, as well as jsonschema's dependencies.
• pymongo should appear as via A, B, and C in the output requirements.txt.

Actual result

• jsonschema is absent from the compiled file (i.e., C-specific dependencies are lost).
• pymongo only appears as via A and B.

Additional observations

• This behaviour only appears with pip-tools>=6.3.1. Version <=6.3.0 does what I consider to be the correct behaviour, which is to lock C's dependencies too.
• If B is modified to remove the dependency on C, then the compiled requirements.txt does contain jsonschema on 6.3.1 and above, as expected.
• Modifying B's setup.py to include C via a VCS URL does not produce the correct result either.
• Depending on B and C via non-editable URLs does not seem to affect the result.

[AndydeCleyre]

I believe this is fixed in #1519. @atugushev do you have some time to review?

[RedRoserade]

Indeed it does seem to fix it:

• https://github.com/RedRoserade/pip-tools-repro-repo-a/blob/main/compile-pr-1519.sh
• https://github.com/RedRoserade/pip-tools-repro-repo-a/blob/main/requirements-pr-1519.txt
• RedRoserade/pip-tools-repro-repo-a@80a89d6

[RedRoserade]

In fact, I think this is a duplicate of #1505, now that I look at it.

[atugushev]

Closed as a dupe of #1505.