pip-compile breaks when using paths outside of the current directory

[thedoctorjtd]

In commit 809239a the logic for relative/absolute path detection was reworked, however there seem to be some issues with it.

When running pip compile with pip-compile requirements.in the following scenarios will cause errors:

• Having a -r with a relative path (-r ../otherProject/requirements.in)
• Having a -r with an absolute path (-r D:\code\otherProject\requirements.in)

Both of these break with the same error:

suffix = file_path.relative_to(pathlib.Path.cwd()).as_posix()
  File "C:\Python310\lib\pathlib.py", line 818, in relative_to
    raise ValueError("{!r} is not in the subpath of {!r}"

I understand why these specificity changes were necessary to prevent possible ambiguity, however there should be a fallback when the preferred path does not exist vs an error.

Environment Versions

1. OS Type: - Win 11
2. Python version: Python 3.10.11
3. pip version: pip 25.2
4. pip-tools version: pip-compile, version 7.5.0

Steps to replicate

Run pip compile with pip-compile requirements.in with the following scenarios:

• Having a -r with a relative path (-r ../otherProject/requirements.in)
• Having a -r with an absolute path (-r D:\code\otherProject\requirements.in)

Expected result

pip-compile would use the files specified since there were not other options which were more preferred.

Actual result

suffix = file_path.relative_to(pathlib.Path.cwd()).as_posix()
  File "C:\Python310\lib\pathlib.py", line 818, in relative_to
    raise ValueError("{!r} is not in the subpath of {!r}"

[AndydeCleyre]

@sirosen

IIRC, at least six years ago, pathlib's relative_to function is limited to subdirectories, so not what we generally expect. os.path.relpath may be suitable instead.

[webknjaz]

It might be a good idea to have some shim for pathlib objects, then..

[sirosen]

Yeah, this sounds vaguely familiar. I think pathlib has some rules which are meant to protect against accidentally crossing boundaries between different physical file systems.

I'll need add a test case to the tests which were included with the path formatting changes to run against ../foo/requirements.in and that should reproduce this.

[sirosen]

I think this is the most significant new bug since 7.5.0 still in main after recent fixes.
I wanted to get it done, since it shouldn't (🤞) be a difficult fix, but with the click-related changes, I'd rather we cut 7.5.1 very shortly.

This is on my TODO list as high priority (after a bit of a pip-tools hiatus), and I'd like to get 7.5.2 done soon, with this and other fixes.