Quart-SQLAlchemy installation from pip is causing a downgrade attack

[yusurko]

My project's dependencies (mostly optional) come into conflict. I am in the middle of writing tools to ease migration from flask to quart. Unfortunately, on pip most quart-* counterparts of Flask extensions are unmantained (see https://gitlab.com/wcorrales/quart-csrf/-/issues/1 incident, tldr: werkzeug removing safe_str_cmp() and library relying on it).

Looking on pip, I found quart-sqlalchemy. However, I found out quickly it's not a drop-in replacement for its Flask counterpart. I found configuration not "made for humans" or "as simple as possible", as it seemed to me. Nested dicts are not that aesthetic in Python, you know.

I started writing a tool simplifying that.

However, as I installed dependencies, this happened:

Collecting Quart_SQLALchemy<4.0,>=3.0.0 (from sakuragasaki46_suou==0.5.0.dev29)
  Using cached quart_sqlalchemy-3.0.3-py3-none-any.whl.metadata (4.3 kB)
Collecting peewee<4.0,>=3.0.0 (from sakuragasaki46_suou==0.5.0.dev29)
  Downloading peewee-3.18.2.tar.gz (949 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 949.2/949.2 kB 583.8 kB/s eta 0:00:00
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... done
  Using cached peewee-3.18.1-cp313-cp313-linux_x86_64.whl
  Downloading peewee-3.18.0.tar.gz (948 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 949.0/949.0 kB 1.3 MB/s eta 0:00:00
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... done
INFO: pip is still looking at multiple versions of quart-sqlalchemy to determine which version is compatible with other requirements. This could take a while.
  Using cached peewee-3.17.9-cp313-cp313-linux_x86_64.whl
  Downloading peewee-3.17.8.tar.gz (948 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 948.2/948.2 kB 1.5 MB/s eta 0:00:00
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... done
  Downloading peewee-3.17.7.tar.gz (939 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 939.5/939.5 kB 1.5 MB/s eta 0:00:00
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... done
INFO: This is taking longer than usual. You might need to provide the dependency resolver with stricter constraints to reduce runtime. See https://pip.pypa.io/warnings/backtracking for guidance. If you want to abort this run, press Ctrl + C.
  Downloading peewee-3.17.6.tar.gz (3.0 MB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3.0/3.0 MB 2.4 MB/s eta 0:00:00
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... done
  Using cached peewee-3.17.5.tar.gz (3.0 MB)
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... done
  Downloading peewee-3.17.3.tar.gz (3.0 MB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3.0/3.0 MB 2.1 MB/s eta 0:00:00
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... done
  Downloading peewee-3.17.2.tar.gz (938 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 939.0/939.0 kB 2.5 MB/s eta 0:00:00
^C  Installing build dependencies ... canceled
ERROR: Operation cancelled by user

Collecting Quart_SQLALchemy<4.0,>=3.0.0 (from sakuragasaki46_suou==0.5.0.dev29)
  Using cached quart_sqlalchemy-3.0.3-py3-none-any.whl.metadata (4.3 kB)
Collecting markdown>=3.0.0 (from sakuragasaki46_suou==0.5.0.dev29)
  Downloading markdown-3.8.1-py3-none-any.whl.metadata (5.1 kB)
  Downloading markdown-3.8-py3-none-any.whl.metadata (5.1 kB)
  Using cached Markdown-3.7-py3-none-any.whl.metadata (7.0 kB)
INFO: pip is still looking at multiple versions of quart-sqlalchemy to determine which version is compatible with other requirements. This could take a while.
  Using cached Markdown-3.6-py3-none-any.whl.metadata (7.0 kB)
  Downloading Markdown-3.5.2-py3-none-any.whl.metadata (7.0 kB)
  Using cached Markdown-3.5.1-py3-none-any.whl.metadata (7.1 kB)
INFO: This is taking longer than usual. You might need to provide the dependency resolver with stricter constraints to reduce runtime. See https://pip.pypa.io/warnings/backtracking for guidance. If you want to abort this run, press Ctrl + C.
  Downloading Markdown-3.5-py3-none-any.whl.metadata (7.1 kB)
  Downloading Markdown-3.4.4-py3-none-any.whl.metadata (6.9 kB)
  Downloading Markdown-3.4.3-py3-none-any.whl.metadata (6.7 kB)
  Downloading Markdown-3.4.2-py3-none-any.whl.metadata (6.7 kB)
  Downloading Markdown-3.4.1-py3-none-any.whl.metadata (4.6 kB)
  Downloading Markdown-3.4-py3-none-any.whl.metadata (4.6 kB)
  Downloading Markdown-3.3.7-py3-none-any.whl.metadata (4.6 kB)
  Downloading Markdown-3.3.6-py3-none-any.whl.metadata (4.6 kB)
  Downloading Markdown-3.3.4-py3-none-any.whl.metadata (4.6 kB)
  Downloading Markdown-3.3.3-py3-none-any.whl.metadata (4.4 kB)
  Downloading Markdown-3.3.2-py3-none-any.whl.metadata (4.4 kB)
  Downloading Markdown-3.3.1-py3-none-any.whl.metadata (4.4 kB)
  Downloading Markdown-3.3-py3-none-any.whl.metadata (4.4 kB)
  Downloading Markdown-3.2.2-py3-none-any.whl.metadata (2.4 kB)
  Downloading Markdown-3.2.1-py2.py3-none-any.whl.metadata (2.4 kB)
Collecting setuptools>=36 (from markdown>=3.0.0->sakuragasaki46_suou==0.5.0.dev29)
  Using cached setuptools-80.9.0-py3-none-any.whl.metadata (6.6 kB)
  Using cached setuptools-80.8.0-py3-none-any.whl.metadata (6.6 kB)
  Downloading setuptools-80.7.1-py3-none-any.whl.metadata (6.6 kB)
  Downloading setuptools-80.6.0-py3-none-any.whl.metadata (6.6 kB)
  Downloading setuptools-80.4.0-py3-none-any.whl.metadata (6.5 kB)
  Using cached setuptools-80.3.1-py3-none-any.whl.metadata (6.5 kB)
  Downloading setuptools-80.2.0-py3-none-any.whl.metadata (6.5 kB)
  Using cached setuptools-80.1.0-py3-none-any.whl.metadata (6.5 kB)
  Using cached setuptools-80.0.1-py3-none-any.whl.metadata (6.5 kB)
  Downloading setuptools-80.0.0-py3-none-any.whl.metadata (6.5 kB)
  Using cached setuptools-79.0.1-py3-none-any.whl.metadata (6.5 kB)
  Using cached setuptools-79.0.0-py3-none-any.whl.metadata (6.5 kB)
  Downloading setuptools-78.1.1-py3-none-any.whl.metadata (6.5 kB)
  Using cached setuptools-78.1.0-py3-none-any.whl.metadata (6.6 kB)
  Downloading setuptools-78.0.2-py3-none-any.whl.metadata (6.6 kB)
  Downloading setuptools-78.0.1-py3-none-any.whl.metadata (6.6 kB)
  Using cached setuptools-77.0.3-py3-none-any.whl.metadata (6.6 kB)
  Downloading setuptools-77.0.1-py3-none-any.whl.metadata (6.7 kB)
  Downloading setuptools-76.1.0-py3-none-any.whl.metadata (6.7 kB)
  Downloading setuptools-76.0.0-py3-none-any.whl.metadata (6.7 kB)
  Downloading setuptools-75.9.1-py3-none-any.whl.metadata (6.7 kB)
  Downloading setuptools-75.8.2-py3-none-any.whl.metadata (6.7 kB)
  Downloading setuptools-75.8.1-py3-none-any.whl.metadata (6.7 kB)
  Using cached setuptools-75.8.0-py3-none-any.whl.metadata (6.7 kB)
  Using cached setuptools-75.7.0-py3-none-any.whl.metadata (6.7 kB)
  Using cached setuptools-75.6.0-py3-none-any.whl.metadata (6.7 kB)
  Downloading setuptools-75.5.0-py3-none-any.whl.metadata (6.8 kB)
  Downloading setuptools-75.4.0-py3-none-any.whl.metadata (6.8 kB)
  Downloading setuptools-75.3.2-py3-none-any.whl.metadata (6.9 kB)
  Downloading setuptools-75.3.1-py3-none-any.whl.metadata (6.9 kB)
  Downloading setuptools-75.3.0-py3-none-any.whl.metadata (6.9 kB)
  Downloading setuptools-75.2.0-py3-none-any.whl.metadata (6.9 kB)
  Downloading setuptools-75.1.0-py3-none-any.whl.metadata (6.9 kB)
  Downloading setuptools-75.0.0-py3-none-any.whl.metadata (6.9 kB)
  Downloading setuptools-74.1.3-py3-none-any.whl.metadata (6.7 kB)
  Downloading setuptools-74.1.2-py3-none-any.whl.metadata (6.7 kB)
  Downloading setuptools-74.1.1-py3-none-any.whl.metadata (6.7 kB)
  Downloading setuptools-74.1.0-py3-none-any.whl.metadata (6.7 kB)
  Downloading setuptools-74.0.0-py3-none-any.whl.metadata (6.7 kB)
  Downloading setuptools-73.0.1-py3-none-any.whl.metadata (6.6 kB)
  Downloading setuptools-73.0.0-py3-none-any.whl.metadata (6.6 kB)
  Downloading setuptools-72.2.0-py3-none-any.whl.metadata (6.6 kB)
  Downloading setuptools-72.1.0-py3-none-any.whl.metadata (6.6 kB)
  Downloading setuptools-71.1.0-py3-none-any.whl.metadata (6.6 kB)
  Downloading setuptools-71.0.4-py3-none-any.whl.metadata (6.5 kB)
  Downloading setuptools-71.0.3-py3-none-any.whl.metadata (6.5 kB)
  Downloading setuptools-71.0.2-py3-none-any.whl.metadata (6.5 kB)
  Downloading setuptools-71.0.0-py3-none-any.whl.metadata (6.5 kB)
  Downloading setuptools-70.3.0-py3-none-any.whl.metadata (5.8 kB)
  Downloading setuptools-70.2.0-py3-none-any.whl.metadata (5.8 kB)
  Downloading setuptools-70.1.1-py3-none-any.whl.metadata (6.0 kB)
  Downloading setuptools-70.1.0-py3-none-any.whl.metadata (6.0 kB)
  Using cached setuptools-70.0.0-py3-none-any.whl.metadata (5.9 kB)
  Downloading setuptools-69.5.1-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-69.5.0-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-69.4.2-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-69.4.1-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-69.3.1-py3-none-any.whl.metadata (6.2 kB)
  Using cached setuptools-69.2.0-py3-none-any.whl.metadata (6.3 kB)
  Downloading setuptools-69.1.1-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-69.1.0-py3-none-any.whl.metadata (6.1 kB)
  Using cached setuptools-69.0.3-py3-none-any.whl.metadata (6.3 kB)
  Using cached setuptools-69.0.2-py3-none-any.whl.metadata (6.3 kB)
  Downloading setuptools-69.0.1-py3-none-any.whl.metadata (6.3 kB)
  Downloading setuptools-69.0.0-py3-none-any.whl.metadata (6.3 kB)
  Downloading setuptools-68.2.2-py3-none-any.whl.metadata (6.3 kB)
  Downloading setuptools-68.2.1-py3-none-any.whl.metadata (6.3 kB)
  Downloading setuptools-68.2.0-py3-none-any.whl.metadata (6.3 kB)
  Downloading setuptools-68.1.2-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-68.1.0-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-68.0.0-py3-none-any.whl.metadata (6.4 kB)
  Downloading setuptools-67.8.0-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-67.7.2-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-67.7.1-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-67.7.0-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-67.6.1-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-67.6.0-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-67.5.1-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-67.5.0-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-67.4.0-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-67.3.3-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-67.3.2-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-67.3.1-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-67.2.0-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-67.1.0-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-67.0.0-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-66.1.1-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-66.1.0-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-66.0.0-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-65.7.0-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-65.6.3-py3-none-any.whl.metadata (6.1 kB)
  Downloading setuptools-65.6.2-py3-none-any.whl.metadata (6.1 kB)
  Downloading setuptools-65.6.1-py3-none-any.whl.metadata (6.1 kB)
  Downloading setuptools-65.6.0-py3-none-any.whl.metadata (6.1 kB)
  Downloading setuptools-65.5.1-py3-none-any.whl.metadata (6.3 kB)
  Downloading setuptools-65.5.0-py3-none-any.whl.metadata (6.3 kB)
  Downloading setuptools-65.4.1-py3-none-any.whl.metadata (6.3 kB)
  Downloading setuptools-65.4.0-py3-none-any.whl.metadata (6.3 kB)
  Downloading setuptools-65.3.0-py3-none-any.whl.metadata (6.3 kB)
  Downloading setuptools-65.2.0-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-65.1.1-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-65.1.0-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-65.0.2-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-65.0.1-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-65.0.0-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-64.0.3-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-64.0.2-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-64.0.1-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-64.0.0-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-63.4.3-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-63.4.2-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-63.4.1-py3-none-any.whl.metadata (6.2 kB)
  Downloading setuptools-63.4.0-py3-none-any.whl.metadata (6.2 kB)
^CERROR: Operation cancelled by user

What I have found in the quart-sqlalchemy's pyproject.toml:

### ... blah blah ... ###
dependencies = [
    "quart<0.20.0,>=0.18.3",
    "werkzeug<3.1.0,>=2.2.0",
    "blinker<1.7,>=1.5",
    "SQLAlchemy[asyncio]<2.1.0,>=2.0.0",
    "SQLAlchemy-Utils",
    "anyio>=3.0.0,<4",
    "pydantic~=1.10.13",
    "tenacity~=8.0.1",
    "sqlapagination",
    "exceptiongroup",
]
### ... blah blah ... ###

Yes, dependencies having strict upper constraints. I also see the pyproject has not been modified in 2 years.

However, I and many others may want their dependencies updated for various reasons.

Leaving this as is. Stay safe.