Duplicate packages in lockfile with different versions

[Adam-D-Lewis]

Checklist

• I added a descriptive title
• I searched open reports and couldn't find a duplicate

What happened?

I run conda-lock -f pyproject.toml --lockfile conda-lock.yml

# pyproject.toml
[build-system]
requires = ["poetry-core>=1.0.0"]
build-backend = "poetry.core.masonry.api"

[tool.poetry.dependencies]
mailgun = { version = "*", source = "pypi" }  # only depends on requests
requests = "<2.32"

[tool.conda-lock]
channels = ['conda-forge']
platforms = ['linux-64']

I get the following conda-lock.yml (expand)

Full Conda Lock Yaml

# This lock file was generated by conda-lock (https://github.com/conda/conda-lock). DO NOT EDIT!
#
# A "lock file" contains a concrete list of package versions (with checksums) to be installed. Unlike
# e.g. `conda env create`, the resulting environment will not change as new package versions become
# available, unless you explicitly update the lock file.
#
# Install this environment as "YOURENV" with:
#     conda-lock install -n YOURENV conda-lock.yml
# To update a single package to the latest version compatible with the version constraints in the source:
#     conda-lock lock  --lockfile conda-lock.yml --update PACKAGE
# To re-solve the entire environment, e.g. after changing a version constraint in the source file:
#     conda-lock -f pyproject.toml --lockfile conda-lock.yml
version: 1
metadata:
  content_hash:
    linux-64: f38f85a274b6b83c597335986a0008db2bac0cb9d7dd3c760ae1931cede8f484
  channels:
  - url: conda-forge
    used_env_vars: []
  platforms:
  - linux-64
  sources:
  - pyproject.toml
package:
- name: _libgcc_mutex
  version: '0.1'
  manager: conda
  platform: linux-64
  dependencies: {}
  url: https://conda.anaconda.org/conda-forge/linux-64/_libgcc_mutex-0.1-conda_forge.tar.bz2
  hash:
    md5: d7c89558ba9fa0495403155b64376d81
    sha256: fe51de6107f9edc7aa4f786a70f4a883943bc9d39b3bb7307c04c41410990726
  category: main
  optional: false
- name: _openmp_mutex
  version: '4.5'
  manager: conda
  platform: linux-64
  dependencies:
    _libgcc_mutex: '0.1'
    libgomp: '>=7.5.0'
  url: https://conda.anaconda.org/conda-forge/linux-64/_openmp_mutex-4.5-2_gnu.tar.bz2
  hash:
    md5: 73aaf86a425cc6e73fcf236a5a46396d
    sha256: fbe2c5e56a653bebb982eda4876a9178aedfc2b545f25d0ce9c4c0b508253d22
  category: main
  optional: false
- name: brotli-python
  version: 1.1.0
  manager: conda
  platform: linux-64
  dependencies:
    __glibc: '>=2.17,<3.0.a0'
    libgcc: '>=13'
    libstdcxx: '>=13'
    python: '>=3.13,<3.14.0a0'
    python_abi: 3.13.*
  url: https://conda.anaconda.org/conda-forge/linux-64/brotli-python-1.1.0-py313h46c70d0_3.conda
  hash:
    md5: 2babfedd9588ad40c7113ddfe6a5ca82
    sha256: e510ad1db7ea882505712e815ff02514490560fd74b5ec3a45a6c7cf438f754d
  category: main
  optional: false
- name: bzip2
  version: 1.0.8
  manager: conda
  platform: linux-64
  dependencies:
    __glibc: '>=2.17,<3.0.a0'
    libgcc-ng: '>=12'
  url: https://conda.anaconda.org/conda-forge/linux-64/bzip2-1.0.8-h4bc722e_7.conda
  hash:
    md5: 62ee74e96c5ebb0af99386de58cf9553
    sha256: 5ced96500d945fb286c9c838e54fa759aa04a7129c59800f0846b4335cee770d
  category: main
  optional: false
- name: ca-certificates
  version: 2025.6.15
  manager: conda
  platform: linux-64
  dependencies:
    __unix: ''
  url: https://conda.anaconda.org/conda-forge/noarch/ca-certificates-2025.6.15-hbd8a1cb_0.conda
  hash:
    md5: 72525f07d72806e3b639ad4504c30ce5
    sha256: 7cfec9804c84844ea544d98bda1d9121672b66ff7149141b8415ca42dfcd44f6
  category: main
  optional: false
- name: certifi
  version: 2025.6.15
  manager: conda
  platform: linux-64
  dependencies:
    python: '>=3.9'
  url: https://conda.anaconda.org/conda-forge/noarch/certifi-2025.6.15-pyhd8ed1ab_0.conda
  hash:
    md5: 781d068df0cc2407d4db0ecfbb29225b
    sha256: d71c85835813072cd6d7ce4b24be34215cd90c104785b15a5d58f4cd0cb50778
  category: main
  optional: false
- name: cffi
  version: 1.17.1
  manager: conda
  platform: linux-64
  dependencies:
    __glibc: '>=2.17,<3.0.a0'
    libffi: '>=3.4,<4.0a0'
    libgcc: '>=13'
    pycparser: ''
    python: '>=3.13.0rc1,<3.14.0a0'
    python_abi: 3.13.*
  url: https://conda.anaconda.org/conda-forge/linux-64/cffi-1.17.1-py313hfab6e84_0.conda
  hash:
    md5: ce6386a5892ef686d6d680c345c40ad1
    sha256: 73cd6199b143a8a6cbf733ce124ed57defc1b9a7eab9b10fd437448caf8eaa45
  category: main
  optional: false
- name: charset-normalizer
  version: 3.4.2
  manager: conda
  platform: linux-64
  dependencies:
    python: '>=3.9'
  url: https://conda.anaconda.org/conda-forge/noarch/charset-normalizer-3.4.2-pyhd8ed1ab_0.conda
  hash:
    md5: 40fe4284b8b5835a9073a645139f35af
    sha256: 535ae5dcda8022e31c6dc063eb344c80804c537a5a04afba43a845fa6fa130f5
  category: main
  optional: false
- name: h2
  version: 4.2.0
  manager: conda
  platform: linux-64
  dependencies:
    hpack: '>=4.1,<5'
    hyperframe: '>=6.1,<7'
    python: '>=3.9'
  url: https://conda.anaconda.org/conda-forge/noarch/h2-4.2.0-pyhd8ed1ab_0.conda
  hash:
    md5: b4754fb1bdcb70c8fd54f918301582c6
    sha256: 0aa1cdc67a9fe75ea95b5644b734a756200d6ec9d0dff66530aec3d1c1e9df75
  category: main
  optional: false
- name: hpack
  version: 4.1.0
  manager: conda
  platform: linux-64
  dependencies:
    python: '>=3.9'
  url: https://conda.anaconda.org/conda-forge/noarch/hpack-4.1.0-pyhd8ed1ab_0.conda
  hash:
    md5: 0a802cb9888dd14eeefc611f05c40b6e
    sha256: 6ad78a180576c706aabeb5b4c8ceb97c0cb25f1e112d76495bff23e3779948ba
  category: main
  optional: false
- name: hyperframe
  version: 6.1.0
  manager: conda
  platform: linux-64
  dependencies:
    python: '>=3.9'
  url: https://conda.anaconda.org/conda-forge/noarch/hyperframe-6.1.0-pyhd8ed1ab_0.conda
  hash:
    md5: 8e6923fc12f1fe8f8c4e5c9f343256ac
    sha256: 77af6f5fe8b62ca07d09ac60127a30d9069fdc3c68d6b256754d0ffb1f7779f8
  category: main
  optional: false
- name: idna
  version: '3.10'
  manager: conda
  platform: linux-64
  dependencies:
    python: '>=3.9'
  url: https://conda.anaconda.org/conda-forge/noarch/idna-3.10-pyhd8ed1ab_1.conda
  hash:
    md5: 39a4f67be3286c86d696df570b1201b7
    sha256: d7a472c9fd479e2e8dcb83fb8d433fce971ea369d704ece380e876f9c3494e87
  category: main
  optional: false
- name: ld_impl_linux-64
  version: '2.43'
  manager: conda
  platform: linux-64
  dependencies:
    __glibc: '>=2.17,<3.0.a0'
  url: https://conda.anaconda.org/conda-forge/linux-64/ld_impl_linux-64-2.43-h1423503_5.conda
  hash:
    md5: 6dc9e1305e7d3129af4ad0dabda30e56
    sha256: dcd2b1a065bbf5c54004ddf6551c775a8eb6993c8298ca8a6b92041ed413f785
  category: main
  optional: false
- name: libexpat
  version: 2.7.0
  manager: conda
  platform: linux-64
  dependencies:
    __glibc: '>=2.17,<3.0.a0'
    libgcc: '>=13'
  url: https://conda.anaconda.org/conda-forge/linux-64/libexpat-2.7.0-h5888daf_0.conda
  hash:
    md5: db0bfbe7dd197b68ad5f30333bae6ce0
    sha256: 33ab03438aee65d6aa667cf7d90c91e5e7d734c19a67aa4c7040742c0a13d505
  category: main
  optional: false
- name: libffi
  version: 3.4.6
  manager: conda
  platform: linux-64
  dependencies:
    __glibc: '>=2.17,<3.0.a0'
    libgcc: '>=13'
  url: https://conda.anaconda.org/conda-forge/linux-64/libffi-3.4.6-h2dba641_1.conda
  hash:
    md5: ede4673863426c0883c0063d853bbd85
    sha256: 764432d32db45466e87f10621db5b74363a9f847d2b8b1f9743746cd160f06ab
  category: main
  optional: false
- name: libgcc
  version: 15.1.0
  manager: conda
  platform: linux-64
  dependencies:
    __glibc: '>=2.17,<3.0.a0'
    _openmp_mutex: '>=4.5'
  url: https://conda.anaconda.org/conda-forge/linux-64/libgcc-15.1.0-h767d61c_2.conda
  hash:
    md5: ea8ac52380885ed41c1baa8f1d6d2b93
    sha256: 0024f9ab34c09629621aefd8603ef77bf9d708129b0dd79029e502c39ffc2195
  category: main
  optional: false
- name: libgcc-ng
  version: 15.1.0
  manager: conda
  platform: linux-64
  dependencies:
    libgcc: 15.1.0
  url: https://conda.anaconda.org/conda-forge/linux-64/libgcc-ng-15.1.0-h69a702a_2.conda
  hash:
    md5: ddca86c7040dd0e73b2b69bd7833d225
    sha256: 0ab5421a89f090f3aa33841036bb3af4ed85e1f91315b528a9d75fab9aad51ae
  category: main
  optional: false
- name: libgomp
  version: 15.1.0
  manager: conda
  platform: linux-64
  dependencies:
    __glibc: '>=2.17,<3.0.a0'
  url: https://conda.anaconda.org/conda-forge/linux-64/libgomp-15.1.0-h767d61c_2.conda
  hash:
    md5: fbe7d535ff9d3a168c148e07358cd5b1
    sha256: 05fff3dc7e80579bc28de13b511baec281c4343d703c406aefd54389959154fb
  category: main
  optional: false
- name: liblzma
  version: 5.8.1
  manager: conda
  platform: linux-64
  dependencies:
    __glibc: '>=2.17,<3.0.a0'
    libgcc: '>=13'
  url: https://conda.anaconda.org/conda-forge/linux-64/liblzma-5.8.1-hb9d3cd8_2.conda
  hash:
    md5: 1a580f7796c7bf6393fddb8bbbde58dc
    sha256: f2591c0069447bbe28d4d696b7fcb0c5bd0b4ac582769b89addbcf26fb3430d8
  category: main
  optional: false
- name: libmpdec
  version: 4.0.0
  manager: conda
  platform: linux-64
  dependencies:
    __glibc: '>=2.17,<3.0.a0'
    libgcc: '>=13'
  url: https://conda.anaconda.org/conda-forge/linux-64/libmpdec-4.0.0-hb9d3cd8_0.conda
  hash:
    md5: c7e925f37e3b40d893459e625f6a53f1
    sha256: 3aa92d4074d4063f2a162cd8ecb45dccac93e543e565c01a787e16a43501f7ee
  category: main
  optional: false
- name: libsqlite
  version: 3.50.1
  manager: conda
  platform: linux-64
  dependencies:
    __glibc: '>=2.17,<3.0.a0'
    libgcc: '>=13'
    libzlib: '>=1.3.1,<2.0a0'
  url: https://conda.anaconda.org/conda-forge/linux-64/libsqlite-3.50.1-hee588c1_4.conda
  hash:
    md5: c79ba4d93602695bc60c6960ee59d2b1
    sha256: ffd84568ec99d3614f226f1bcbfe46b3fa2f7cb253acb14ff351dc17e7854ea7
  category: main
  optional: false
- name: libstdcxx
  version: 15.1.0
  manager: conda
  platform: linux-64
  dependencies:
    __glibc: '>=2.17,<3.0.a0'
    libgcc: 15.1.0
  url: https://conda.anaconda.org/conda-forge/linux-64/libstdcxx-15.1.0-h8f9b012_2.conda
  hash:
    md5: 1cb1c67961f6dd257eae9e9691b341aa
    sha256: 6ae3d153e78f6069d503d9309f2cac6de5b93d067fc6433160a4c05226a5dad4
  category: main
  optional: false
- name: libuuid
  version: 2.38.1
  manager: conda
  platform: linux-64
  dependencies:
    libgcc-ng: '>=12'
  url: https://conda.anaconda.org/conda-forge/linux-64/libuuid-2.38.1-h0b41bf4_0.conda
  hash:
    md5: 40b61aab5c7ba9ff276c41cfffe6b80b
    sha256: 787eb542f055a2b3de553614b25f09eefb0a0931b0c87dbcce6efdfd92f04f18
  category: main
  optional: false
- name: libzlib
  version: 1.3.1
  manager: conda
  platform: linux-64
  dependencies:
    __glibc: '>=2.17,<3.0.a0'
    libgcc: '>=13'
  url: https://conda.anaconda.org/conda-forge/linux-64/libzlib-1.3.1-hb9d3cd8_2.conda
  hash:
    md5: edb0dca6bc32e4f4789199455a1dbeb8
    sha256: d4bfe88d7cb447768e31650f06257995601f89076080e76df55e3112d4e47dc4
  category: main
  optional: false
- name: ncurses
  version: '6.5'
  manager: conda
  platform: linux-64
  dependencies:
    __glibc: '>=2.17,<3.0.a0'
    libgcc: '>=13'
  url: https://conda.anaconda.org/conda-forge/linux-64/ncurses-6.5-h2d0b736_3.conda
  hash:
    md5: 47e340acb35de30501a76c7c799c41d7
    sha256: 3fde293232fa3fca98635e1167de6b7c7fda83caf24b9d6c91ec9eefb4f4d586
  category: main
  optional: false
- name: openssl
  version: 3.5.0
  manager: conda
  platform: linux-64
  dependencies:
    __glibc: '>=2.17,<3.0.a0'
    ca-certificates: ''
    libgcc: '>=13'
  url: https://conda.anaconda.org/conda-forge/linux-64/openssl-3.5.0-h7b32b05_1.conda
  hash:
    md5: de356753cfdbffcde5bb1e86e3aa6cd0
    sha256: b4491077c494dbf0b5eaa6d87738c22f2154e9277e5293175ec187634bd808a0
  category: main
  optional: false
- name: pycparser
  version: '2.22'
  manager: conda
  platform: linux-64
  dependencies:
    python: ''
  url: https://conda.anaconda.org/conda-forge/noarch/pycparser-2.22-pyh29332c3_1.conda
  hash:
    md5: 12c566707c80111f9799308d9e265aef
    sha256: 79db7928d13fab2d892592223d7570f5061c192f27b9febd1a418427b719acc6
  category: main
  optional: false
- name: pysocks
  version: 1.7.1
  manager: conda
  platform: linux-64
  dependencies:
    __unix: ''
    python: '>=3.9'
  url: https://conda.anaconda.org/conda-forge/noarch/pysocks-1.7.1-pyha55dd90_7.conda
  hash:
    md5: 461219d1a5bd61342293efa2c0c90eac
    sha256: ba3b032fa52709ce0d9fd388f63d330a026754587a2f461117cac9ab73d8d0d8
  category: main
  optional: false
- name: python
  version: 3.13.5
  manager: conda
  platform: linux-64
  dependencies:
    __glibc: '>=2.17,<3.0.a0'
    bzip2: '>=1.0.8,<2.0a0'
    ld_impl_linux-64: '>=2.36.1'
    libexpat: '>=2.7.0,<3.0a0'
    libffi: '>=3.4.6,<3.5.0a0'
    libgcc: '>=13'
    liblzma: '>=5.8.1,<6.0a0'
    libmpdec: '>=4.0.0,<5.0a0'
    libsqlite: '>=3.50.1,<4.0a0'
    libuuid: '>=2.38.1,<3.0a0'
    libzlib: '>=1.3.1,<2.0a0'
    ncurses: '>=6.5,<7.0a0'
    openssl: '>=3.5.0,<4.0a0'
    python_abi: 3.13.*
    readline: '>=8.2,<9.0a0'
    tk: '>=8.6.13,<8.7.0a0'
    tzdata: ''
  url: https://conda.anaconda.org/conda-forge/linux-64/python-3.13.5-hec9711d_102_cp313.conda
  hash:
    md5: 89e07d92cf50743886f41638d58c4328
    sha256: c2cdcc98ea3cbf78240624e4077e164dc9d5588eefb044b4097c3df54d24d504
  category: main
  optional: false
- name: python_abi
  version: '3.13'
  manager: conda
  platform: linux-64
  dependencies: {}
  url: https://conda.anaconda.org/conda-forge/noarch/python_abi-3.13-7_cp313.conda
  hash:
    md5: e84b44e6300f1703cb25d29120c5b1d8
    sha256: 0595134584589064f56e67d3de1d8fcbb673a972946bce25fb593fb092fdcd97
  category: main
  optional: false
- name: readline
  version: '8.2'
  manager: conda
  platform: linux-64
  dependencies:
    libgcc: '>=13'
    ncurses: '>=6.5,<7.0a0'
  url: https://conda.anaconda.org/conda-forge/linux-64/readline-8.2-h8c095d6_2.conda
  hash:
    md5: 283b96675859b20a825f8fa30f311446
    sha256: 2d6d0c026902561ed77cd646b5021aef2d4db22e57a5b0178dfc669231e06d2c
  category: main
  optional: false
- name: requests
  version: 2.31.0
  manager: conda
  platform: linux-64
  dependencies:
    certifi: '>=2017.4.17'
    charset-normalizer: '>=2,<4'
    idna: '>=2.5,<4'
    python: '>=3.7'
    urllib3: '>=1.21.1,<3'
  url: https://conda.anaconda.org/conda-forge/noarch/requests-2.31.0-pyhd8ed1ab_0.conda
  hash:
    md5: a30144e4156cdbb236f99ebb49828f8b
    sha256: 9f629d6fd3c8ac5f2a198639fe7af87c4db2ac9235279164bfe0fcb49d8c4bad
  category: main
  optional: false
- name: tk
  version: 8.6.13
  manager: conda
  platform: linux-64
  dependencies:
    __glibc: '>=2.17,<3.0.a0'
    libgcc: '>=13'
    libzlib: '>=1.3.1,<2.0a0'
  url: https://conda.anaconda.org/conda-forge/linux-64/tk-8.6.13-noxft_hd72426e_102.conda
  hash:
    md5: a0116df4f4ed05c303811a837d5b39d8
    sha256: a84ff687119e6d8752346d1d408d5cf360dee0badd487a472aa8ddedfdc219e1
  category: main
  optional: false
- name: tzdata
  version: 2025b
  manager: conda
  platform: linux-64
  dependencies: {}
  url: https://conda.anaconda.org/conda-forge/noarch/tzdata-2025b-h78e105d_0.conda
  hash:
    md5: 4222072737ccff51314b5ece9c7d6f5a
    sha256: 5aaa366385d716557e365f0a4e9c3fca43ba196872abbbe3d56bb610d131e192
  category: main
  optional: false
- name: urllib3
  version: 2.5.0
  manager: conda
  platform: linux-64
  dependencies:
    brotli-python: '>=1.0.9'
    h2: '>=4,<5'
    pysocks: '>=1.5.6,<2.0,!=1.5.7'
    python: '>=3.9'
    zstandard: '>=0.18.0'
  url: https://conda.anaconda.org/conda-forge/noarch/urllib3-2.5.0-pyhd8ed1ab_0.conda
  hash:
    md5: 436c165519e140cb08d246a4472a9d6a
    sha256: 4fb9789154bd666ca74e428d973df81087a697dbb987775bc3198d2215f240f8
  category: main
  optional: false
- name: zstandard
  version: 0.23.0
  manager: conda
  platform: linux-64
  dependencies:
    __glibc: '>=2.17,<3.0.a0'
    cffi: '>=1.11'
    libgcc: '>=13'
    python: '>=3.13,<3.14.0a0'
    python_abi: 3.13.*
  url: https://conda.anaconda.org/conda-forge/linux-64/zstandard-0.23.0-py313h536fd9c_2.conda
  hash:
    md5: a026ac7917310da90a98eac2c782723c
    sha256: ea9c542ef78c9e3add38bf1032e8ca5d18703114db353f6fca5c498f923f8ab8
  category: main
  optional: false
- name: mailgun
  version: 1.0.1
  manager: pip
  platform: linux-64
  dependencies:
    requests: '>=2.32.3'
  url: https://files.pythonhosted.org/packages/ae/38/96947e2b0e179cd3d10e92512bd6099341b81956e1d9e98a8a04dc36dcac/mailgun-1.0.1-py3-none-any.whl
  hash:
    sha256: 637b914e1737e2ce87b3e0b4c1328ecc04ae7ee1ba5fdad2f94a105435ec6f55
  category: main
  optional: false
- name: requests
  version: 2.32.4
  manager: pip
  platform: linux-64
  dependencies:
    certifi: '>=2017.4.17'
    charset-normalizer: '>=2,<4'
    idna: '>=2.5,<4'
    urllib3: '>=1.21.1,<3'
  url: https://files.pythonhosted.org/packages/7c/e4/56027c4a6b4ae70ca9de302488c5ca95ad4a39e190093d6c1a8ace08341b/requests-2.32.4-py3-none-any.whl
  hash:
    sha256: 27babd3cda2a6d50b30443204ee89830707d396671944c998b5975b031ac2b2c
  category: main
  optional: false

which notably contains the requests package twice, version 2.32.4 managed by pip and version 2.31.0 managed by conda. if you run conda-lock install the environment will have requests 2.32.4 from pip. Notably, this violates the requests = "<2.32" constraint in the pyproject file.

I initially thought maybe this was expected behavior and it should just be understood that pip version will take precedence in the final environment since this is consistent with conda behavior I've seen. E.g. Running conda env create -f environment.yaml with the following environment file

name: double-requests
channels:
  - conda-forge
dependencies:
  - python
  - pip
  - requests<2.32
  - pip:
    - mailgun # depends on requests

also results in an environment with requests version 2.32.4 from pip, but @maresb confirmed it was in fact, a bug in this comment.

Additional Context

No response

[maresb]

Hi @Adam-D-Lewis, apologies for the delay in answering the following question of yours. In #479 (comment) you asked

To make sure I understand, would you say the correct behavior in the bug I brough up is that the requests package only shows up once in the conda-lock.yml and it would be the pip managed requests and not the conda managed requests entry?

Disclaimer: I started maintaining conda-lock only after the pip functionality was implemented. So I don't personally understand all the original intents.

However, the README does contain the following:

In all cases, the dependencies of pip-installable packages will also be installed with pip, unless they were already requested by a conda dependency.

I interpret this to mean that requests should be installed via conda since there's no source = "pypi" on requests.