Bug#1030779: python3-fastapi has a metadata dependency on starlette=0.22.0, while Debian bookworm ships 0.23.1

[Enrique]

Package: python3-fastapi
Version: 0.89.1-1
Severity: normal
X-Debbugs-Cc: cqu...@arcor.de

The python3-fastapi debian package on bookworm can be installed and the debian
package dependency is python3-starlette (>= 0.22.0) which is all good.
However, when I try to install a package with pip in a virtual environment
which has fastapi as a dependency I get the following:

Requirement already satisfied: matplotlib in /usr/lib/python3/dist-packages
(from adari-core==0.0.11) (3.6.3)
Requirement already satisfied: fastapi in /usr/lib/python3/dist-packages (from
adari-core==0.0.11) (0.89.1)
Requirement already satisfied: uvicorn in /usr/lib/python3/dist-packages (from
adari-core==0.0.11) (0.17.6)
Requirement already satisfied: requests-unixsocket in /usr/lib/python3/dist-
packages (from adari-core==0.0.11) (0.3.0)
Requirement already satisfied: astropy in /usr/lib/python3/dist-packages (from
adari-core==0.0.11) (5.2.1)
Requirement already satisfied: requests in /usr/lib/python3/dist-packages (from
adari-core==0.0.11) (2.28.1)
Requirement already satisfied: pydantic in /usr/lib/python3/dist-packages (from
adari-core==0.0.11) (1.10.2)
Collecting starlette==0.22.0
Using cached starlette-0.22.0-py3-none-any.whl (64 kB)
Requirement already satisfied: anyio<5,>=3.4.0 in /usr/lib/python3/dist-
packages (from starlette==0.22.0->fastapi->adari-core==0.0.11) (3.6.2)

Note that this is venv with --system-site-packages option, so it should be
using the installed packages. It looks like fastapi pip metadata requires
starlette==0.22.0, and hence the python3-starlette package installed with apt
(which is 0.23.1-1 in bookworm) does not satisfy that and it needs to install
it in the venv.

I believe the problem lies within file /usr/lib/python3/dist-
packages/fastapi-0.89.1.dist-info/METADATA:
...
Requires-Dist: starlette==0.22.0
...

I guess relaxing that to higher than 0.22 would make pip happy and there is no
need then to install a local version of starlette.


-- System Information:
Debian Release: bookworm/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 6.1.0-1-amd64 (SMP w/8 CPU threads; PREEMPT)
Kernel taint flags: TAINT_WARN
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages python3-fastapi depends on:
ii python3 3.10.6-3+b1
ii python3-pydantic 1.10.2-1
ii python3-starlette 0.23.1-1
ii python3-uvicorn 0.17.6-1

python3-fastapi recommends no packages.

python3-fastapi suggests no packages.

-- no debconf information

[Cesar Enrique Garcia Dabo]

I have just realized that there are new fastapi and starlette packages.
However the problem still persists, although now the version
requirements have changed:

Collecting starlette<0.26.0,>=0.25.0
  Using cached starlette-0.25.0-py3-none-any.whl (66 kB)

The current version delivered of starlette is python3-starlette    0.26.1-1

[Cesar Enrique Garcia Dabo]

Just as additional information, running pip check already complains
about this:

$ pip check

fastapi 0.92.0 has requirement starlette<0.26.0,>=0.25.0, but you have
starlette 0.26.1.

[Enrique García]

An update on this after bookworm is already out: it seems that this is
still broken but in a slightly different variant.

The version of fastapi shipped now is 0.92, whereas the starlette
version is 0.26.1. The metadata for fastpi has a requirement that is not
satisfied:

$ grep starlette
/usr/lib/python3/dist-packages/fastapi-0.92.0.dist-info/METADATA
Requires-Dist: starlette<0.26.0,>=0.25.0

Using a minimal LXD container I could reproduce the issue by installing
a package with pip that depends only on fastapi:

$ apt install python3-fastapi python3-pip python3-venv

$ python3 -m venv --system-site-packages test_venv

$ . ./test_venv/bin/activate

$ pip install fastapi-restful-extension
Collecting fastapi-restful-extension
  Using cached fastapi_restful_extension-0.4.2-py3-none-any.whl (6.6 kB)
Requirement already satisfied: fastapi>=0.78.0 in
/usr/lib/python3/dist-packages (from fastapi-restful-extension) (0.92.0)
Requirement already satisfied:
pydantic!=1.7,!=1.7.1,!=1.7.2,!=1.7.3,!=1.8,!=1.8.1,<2.0.0,>=1.6.2 in
/usr/lib/python3/dist-packages (from
fastapi>=0.78.0->fastapi-restful-extension) (1.10.4)
Collecting starlette<0.26.0,>=0.25.0
  Downloading starlette-0.25.0-py3-none-any.whl (66 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 66.4/66.4 kB 929.9 kB/s
eta 0:00:00

Requirement already satisfied: anyio<5,>=3.4.0 in
/usr/lib/python3/dist-packages (from

starlette<0.26.0,>=0.25.0->fastapi>=0.78.0->fastapi-restful-extension)
(3.6.2)
Installing collected packages: starlette, fastapi-restful-extension
  Attempting uninstall: starlette
    Found existing installation: starlette 0.26.1
    Not uninstalling starlette at /usr/lib/python3/dist-packages,
outside environment /root/test_venv
    Can't uninstall 'starlette'. No files were found to uninstall.
Successfully installed fastapi-restful-extension-0.4.2 starlette-0.25.0

So pip recognizes that the situation is inconsistent. As before, pip
check would complain:

$ pip check
fastapi 0.92.0 has requirement starlette<0.26.0,>=0.25.0, but you have
starlette 0.26.1.

I am not sure which should be the best course of action. I can think of
two possible options:

- Relax the constrain in the metadata to allow also starlette <=0.26.1.
This might be a bit hacky, but it seems that the shipped starlette
0.26.1 is actually working fine with the shipped fastapi 0.92, at least
from a test I did with one small application that uses fastapi.

- Update the fastapi version to 0.94. This one introduces support for
starlette >=0.26.0. I have also tested the combination of 0.94 installed
from pip with starlette 0.26.1 from the bookworm repository and it seems
to work.

[Enrique García]

BTW, this is also broken Debian sid. In that case the installed
starlette is 0.31 but fastapi 0.101.0 requires
starlette<0.28.0,>=0.27.0. It would be nice to fix this before Ubuntu
24.04 picks up this problem.

Thanks!