wheel 0.38.0 not yet published to pypi.org

[defaultbranch]

• 12 days ago, wheel 0.38.0 was released (according to https://github.com/pypa/wheel/tags)

• today, https://pypi.org/project/wheel/ still reports 0.37.1 as "latest"

• since last night, some build of mine fails because some vulnerability checker (pipenv check) recommends replacing wheel 0.37.1 with 0.38.0, but only 0.37.1 can be retrieved

Can you please publish 0.38.0 to pypi.org soon? Thanks!

[mredaelli]

Same

[Alessandro-Ghezzi]

Also on my projects I have the same problem. Can u please update the latest tag? :)

[agronholm]

v0.38.0 was published to PyPI but it was yanked because its circular dependency with setuptools was causing issues. So you do NOT want v0.38.0 un-yanked. I'm not even sure how to resolve this. Previously I tried to use flit as the build back-end to break the cycle, but the world was not ready for wheel to switch to PEP 517 builds entirely, so I got lots of complaints for that. At the very least, the code should be updated to not rely on setuptools except for bdist_wheel. There is work going on in the publicapi branch to this end, and it's nontrivial.

Also on my projects I have the same problem. Can u please update the latest tag? :)

What is this latest tag you're talking about and how do I go about updating it?

[Alessandro-Ghezzi]

v0.38.0 was published to PyPI but it was yanked because its circular dependency with setuptools was causing issues. So you do NOT want v0.38.0 un-yanked. I'm not even sure how to resolve this. Previously I tried to use flit as the build back-end to break the cycle, but the world was not ready for wheel to switch to PEP 517 builds entirely, so I got lots of complaints for that. At the very least, the code should be updated to not rely on setuptools except for bdist_wheel. There is work going on in the publicapi branch to this end, and it's nontrivial.

Also on my projects I have the same problem. Can u please update the latest tag? :)

What is this latest tag you're talking about and how do I go about updating it?

I was referring to v0.38.0.

[agronholm]

But what do you expect me to do here?

[mattip]

Maybe the problem is connected to the PyPI simple index. 3.38 still appears (at the bottom). On the one hand, the package exists, on the other the link at https://pypi.org/project/wheel lists 0.37.1 as the latest. A quick perusal of the code of pipenv did not lead me to how the pipenv check code gets the latest versions, and checking the issues there I did not see an open one about yanked packages showing up in pipenv check. @mredaelli, @Alessandro-Ghezzi could you confirm that this is happening in pipenv check or are you using another tool?

[defaultbranch]

Ok, so I see this actually covered by #470 and 0.38.0 was in fact already published (https://pypi.org/project/wheel/0.38.0/) but yanked. So I close this issue in favor of #470 .

Thanks for the feedback! I'll have to wait for #470 to be resolved.

[agronholm]

I have a minimal PR that should hopefully resolve this (#483). Reviews are welcome.