[tdstein]

Summary

Requirement filtering matched any line containing rsconnect, and local editables were bundled even though Connect can't install them.

 pip_freeze
+  if pip < 20.3: error -> upgrade pip or supply a requirements file
-  pip freeze
+  pip freeze --exclude rsconnect --exclude rsconnect-python

 filter requirements (generated and user-supplied)
-  drop every line containing "rsconnect"
+  drop only the rsconnect / rsconnect-python distributions
+    (parsed name, #egg= name, or an editable pointing at this checkout)

 detect_environment
+  reject editables outside the deployment directory
+    (absolute paths, file: URLs, ../ escapes)
+  allow VCS editables and relative paths inside the deployment directory

Evidence

• Before: my-rsconnect-utils==0.1 and demo @ file:///work/rsconnect-demo were silently dropped. -e /Users/me/localpkg was bundled and failed on Connect.
  After: Unrelated packages are kept. Local editables fail during inspection, and the error lists each offending line.
• New tests cover name filtering, editable classification, and the old-pip error. The opt-in test_pip_compatibility.py passed against pip 20.2.4, 20.3, and 26.3.
• CI is green (27/27 checks).

Merge Danger

Door: two-way

Publishing environments with pip < 20.3 can no longer generate requirements. They can upgrade pip or supply a requirements file. Connect's installer is unaffected. Deploys that used to upload unreachable editables now fail early instead of on the server.

Blast Radius: deployments

Closes #899
Closes #916

🤖 Generated with Claude Code

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://posit-dev.github.io/rsconnect-python/pr-preview/pr-909/
Built to branch gh-pages at 2026-11-05 18:38 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[github-actions]

☂️ Python Coverage

current status: ✅

Overall Coverage

Lines	Covered	Coverage	Threshold	Status
11082	9783	88%	0%	🟢

New Files

No new covered files...

Modified Files

File	Coverage	Status
rsconnect/subprocesses/inspect_environment.py	93%	🟢
TOTAL	93%	🟢

updated for commit: 019dbd3 by action🐍

[joshyam-k]

so if I understand this correctly, previously a local editable install made the Connect build fail with a clear error. Now the line is removed, so the build succeeds and the content fails later with an ImportError at runtime. Is that behavior really better?

[tdstein]

so if I understand this correctly, previously a local editable install made the Connect build fail with a clear error. Now the line is removed, so the build succeeds and the content fails later with an ImportError at runtime. Is that behavior really better?

Yeah I agree with your assessment. If the dependency isn't resolvable on Connect, then it should fail-fast. There are types of editable installs which can be resolved on Connect. Such as, git+http references, and local directly resolutions. We should allow those deps and should error when the dep isn't resolvable.

[amol-]

Why not have a list of packages to expunge instead of a if and helper for each one?

Also this seems now wrong because we publish this package both as rsconnect and rsconnect-python so now the rsconnect dependency would slip throw

[tdstein]

🤖 Addressed:

• There's now a single excluded_distributions = {"rsconnect", "rsconnect-python"} set instead of per-package checks. Requirement lines, editable installs, and the pip freeze --exclude arguments all use it (019dbd3).
• Both published names are filtered, so rsconnect no longer slips through (e89efee). Tests cover rsconnect==…, RSCONNECT @ …, and rsconnect.python, and check that look-alikes such as my-rsconnect-utils are kept.

[joshyam-k]

the inspector runs in the users venv so putting things outside of the standard library here could crash the inspection.

[joshyam-k]

would it be possible to replace the packaging calls with standard library code?

[tdstein]

🤖 #889 removes this constraint. The inspector will run on the CLI's own interpreter, where packaging is always installed, and receive the project's interpreter as --python. The project's interpreter only gets asked for three things, and none of them imports rsconnect or its dependencies:

• its Python version: <python> -I -c "import sys; print(...)"
• its pip version: <python> -m pip --version (optional; we fall back when pip is missing)
• its installed packages: <python> -m pip freeze, or uv pip freeze --python <python>

I ran all three in a venv with neither rsconnect nor packaging, and they work. That also fixes the related uv tool install problem, where the project's venv doesn't have rsconnect at all.

Until #889 lands, the risk from this PR is small. The inspector runs as <python> -m rsconnect..., so rsconnect must already be installed there. packaging is a declared dependency of the released 1.32.0, so a normal install already brings it along. The only setups that newly break are rsconnect importable without its dependencies (--no-deps, PYTHONPATH, a source checkout) on Python ≥ 3.11. On Python ≤ 3.10 the inspector already fails there on toml. Given that, I'd rather keep packaging than write stdlib code to parse requirements.