Nested cdk Python dependencies are not explicitly versioned

[chamcca]

When explicitly setting the version of cdk dependencies for python projects, nested dependencies used by those cdk packages don't use an explicit version ( == ) and instead use a greater-than-or-equal version ( >= ).

This causes unanticipated updates to the cdk packages even when explicitly setting the version.

For example, from a pip install log. Here we explicitly declare a dependency on aws-cdk.core==1.18.0, but the core has a dependency on aws-cdk.cx-api>=1.18.0 which then installs 1.19.0. This happens for all nested dependencies.

Collecting aws-cdk.cx-api>=1.18.0,~=1.18 (from aws-cdk.core==1.18.0->aws-emr-launch==0.3.1.dev0)

Reproduction Steps

in requirements.txt:

aws-cdk.core==1.18.0
aws-cdk-aws.s3==1.18.0

Then:

pip install -e requirements.txt

Error Log

From the example above:

ERROR: aws-cdk-aws-iam 1.19.0 has requirement aws-cdk.core>=1.19.0,~=1.19, but you'll have aws-cdk-core 1.18.0 which is incompatible.
ERROR: aws-cdk-aws-events 1.19.0 has requirement aws-cdk.core>=1.19.0,~=1.19, but you'll have aws-cdk-core 1.18.0 which is incompatible.
ERROR: aws-cdk-aws-kms 1.19.0 has requirement aws-cdk.core>=1.19.0,~=1.19, but you'll have aws-cdk-core 1.18.0 which is incompatible.

Environment

• CLI Version : 1.18.0
• Framework Version: 1.180.0
• OS : OSX
• Language : Python

Other

---

This is 🐛 Bug Report

[RomainMuller]

This is a duplicate of #3517