Installing plugin results in jupyterlab version change after restart

[russellsmithies]

I'm not sure what category this falls under - it was certainly unexpected.
We're running the latest 4.0.7 and have plugins enabled for users. A user searched for the "jupyterlab-snippets" plugin and installed it - we'd used it on older 3.x releases. After restarting jupyterlab it appeared we'd downgraded to v3.6. This was totally unexpected!!
Now I guess I have to block this plugin, but I'm not sure why an incompatable plugin was displayed in the search results? Is restricting plugins to just "@jupyterlab/*" going to solve this or am I going to have to disable all plugins so a user doesn't accidently downgrade jupyterlab?
Ideally the search would only bring back plugins that are compatable with the currently installed jupyterlab version, or is there a way of configuring this already that I've overlooked?

thanx :-)

[welcome]

Thank you for opening your first issue in this project! Engagement like this is essential for open source projects! 🤗

If you haven't done so already, check out Jupyter's Code of Conduct. Also, please try to follow the issue template as it helps other other community members to contribute more effectively.

You can meet the other Jovyans by joining our Discourse forum. There is also an intro thread there where you can stop by and say Hi! 👋

Welcome to the Jupyter community! 🎉

[russellsmithies]

I did see the warnings on the "Extensions" page but I (wrongly) assumed that it would just mean the plugin woudln't work.

[krassowski]

I think that it would make sense to force-pin the version of jupyterlab in the default (pip) plugin manager implementation, so that it is never changed. That would involve updating:

jupyterlab/jupyterlab/extensions/pypi.py

Lines 280 to 293 in 9d360bb

	cmdline = [
	sys.executable,
	"-m",
	"pip",
	"install",
	"--no-input",
	"--quiet",
	"--progress-bar",
	"off",
	]
	if version is not None:
	cmdline.append(f"{name}=={version}")
	else:
	cmdline.append(name)

In addition we should have requires info for packages (but not their dependencies, at least not on a first request!) and should be able to reject installation of incompatible packages, but many will not pin to any version of jupyterlab so it will just not be very reliable.

[russellsmithies]

Thanx, I'm glad it made sense :-)
We run JupyterLab in a conda env as a service so I wasn't sure if it was something from our setup that was weird and causing problems. For now I've installed some useful plugins for our users but disabled the extension manager plugin so it's harder (but probably not impossible) for them to add more.

[Sarthug99]

Hi @krassowski, I am eager to make my first open source contribution. Could you assign this issue to me and provide some guidance on how I can resolve the issue?

[fcollonval]

Thanks for proposing your help @Sarthug99 (as soon as you have commented on an issue you can self assign to it 😉 - we don't have a policy of assigning people to issue).

To provide you with some guidance, a way to solve this would be to add a constrain when executing the pip install command at

jupyterlab/jupyterlab/extensions/pypi.py

Lines 280 to 293 in 9d360bb

	cmdline = [
	sys.executable,
	"-m",
	"pip",
	"install",
	"--no-input",
	"--quiet",
	"--progress-bar",
	"off",
	]
	if version is not None:
	cmdline.append(f"{name}=={version}")
	else:
	cmdline.append(name)

What I would suggest to do is:

1. wrap the lines 280 to 363 within a context that provide you with a temporary named file:

with tempfile.NamedTemporaryFile() as fconstraint:
    cmd_line = [

2. Write the jupyterlab version constrain in that temporary file:

with tempfile.NamedTemporaryFile() as fconstraint:
    fconstraint.write(f"jupyterlab=={__version__}")
    cmd_line = [

You can import __version__ from jupyterlab._version

3. Add the following additional CLI options at the end of the cmd_line list:

with tempfile.NamedTemporaryFile() as fconstraint:
    fconstraint.write(f"jupyterlab=={__version__}")
    cmd_line = [
        # ...
        "--constraint",
        fconstraint.name
    ]

[russellsmithies]

Damn, got caught out again - blimmin arcgis downgraded me to 3.6.
I might have to give up on 4.x until this is sorted as it's making our server unusable :-(

[pipilacha]

I would like to assist in solving this issue

[Sarthug99]

Hi pipilacha! I'm already working on this issue and am almost done with the implementation...