Bundle inproperly report of plugin update if plugin requires package in newer version than napari is shipped with.

[Czaki]

🐛 Bug

Plugins with dependencies newer than shipped with napari will be reported as upgradable in bundled application plugin dialog.

To Reproduce

Steps to reproduce the behavior:

1. Bump minimal plugin requirements above version pinned in napari release (eg minimum version of superqt to 0.3.2 that is higher than in 0.4.15 bundle)
2. Release package to pypi and conda
3. Update of the package will be visible in the plugin dialog but trying to install will fail because of a conflict of dependencies.

Expected behavior

For bundled application plugin manager should not inform that there is an available to install plugin update.

The best solution will be the information that there is an update with the explanation of why it cannot be installed. This will provide clear information to plugin creators about why their plugin update is not installable in bundled version.

Additional context

This bug was first described in napari/napari#4512 (comment)

[jaimergp]

Is this hypothetical or has it happened? We are not pinning anything (yet), except Python and napari. The dependencies should be free to change as long as they are compatible with the napari runtime dependencies.

In a future, a metapackage napari-pinnings will impose further restrictions on how they can change, but not to the point of freezing everything to the installed version. More like allowing packages to change within the patch version or something like that (e.g. superqt is installed with 0.3.2, so we pin to 0.3.x, allowing to update to 0.3.3, but not to 0.4.0).

Take a look at the NAP in napari/napari#4519 for more details. This should be covered there (in a high level), but please let me know if the info is not enough so we can add it!

Thanks!

[Czaki]

I need to investigate it more, but I ealier got the message that napari runtime dependencies will be pinned and cannot be updated during plugin installation.

This is outdated?

[jaimergp]

It's not outdated per se; more like only partially true. There might be some points being confused here, let me elaborate:

• The installers include downloaded tarballs from conda-forge. All the installer does is extract the tarballs and perform conda install with those locally extracted tarballs. In a way this means that the installers will always install the same packages, no matter when you run it.
• Once installed, napari's plugin manager will install plugins by running conda install <plugin-name>. This means that at this point, the dependencies already present can be updated within the constrains imposed by napari itself (quite loose at this point).
• In the future, we want to add a napari-pinnings metapackage to add some more control on how versions can change for certain packages considered critical.

Let me know if this helped or if you need more details!