`--extra-index-url` not included in generated requirements.txt

[smarnach]

Version 7.5.0 of pip-tools no longer passes --extra-index-url from requirements.in on to requirements.txt when using --generate-hashes. Version 7.4.1 still did.

Environment Versions

1. Linux
2. Python version: 3.12.3
3. pip version: 24.0
4. pip-tools version: 7.5.0

Steps to replicate

Here's a minimal shell session reproducing the issue.

1. Write a requirements.in file containing a --extra-index-url line.
2. Run pip-compile --generate-hashes

Expected result

The --extra-index-url line should be included in the generated requirements.txt file.

Actual result

It's not.

[webknjaz]

I seem to remember a security-related request to stop leaking possibly embedded creds. Search the tracker for the details..

[webknjaz]

A quick search from mobile didn't return anything useful. I might retry from the laptop later..

[smarnach]

I can't find anything in the commit history between the two versions. If this is intentional, I'd suggest a prominent notice in the changelog and probably a major version upgrade for such a major breaking change.

[sirosen]

I'm not certain that there is an intentional change. I've gone over the changes for 7.5.0 a couple of times because of all of the work we had to do in order to reassemble the changelog and don't recall anything relevant.

I find it very strange that --generate-hashes is key to this behavior. With it, the option is dropped. Without it, things work as before. I tested with

echo '--extra-index-url https://www.example.com/' | pip-compile --no-header --strip-extras --generate-hashes -o - - > /dev/null

as a simple reproducer.

I have traced this out by bisecting the history of main to the merge of #2195 .
When I snooped around, it seems to be caused by the replacement of the package finder. Reverting that change and running with a sufficiently old pip makes --extra-index-url pop back up in the output.

So I found out where this changed but I have a very limited understanding of why right now. I'm marking this as an accepted bug.

[webknjaz]

I have a very limited understanding of why right now.

It might be that older version of pip-tools didn't require pip to be updated and so it was also older but we bumped the lower bound and so pip is always set to the latest version...