Malformed version requirement specifications can result in unexpected version resolutions

[jtilahun]

Description

Hi, I wanted to open an issue to raise an unexpected observation regarding version resolution. Earlier discussion stemming from this can be found in other GitHub issues:

• DeprecationWarning regarding the use of LegacyVersion pandas-dev/pandas-stubs#612
• cryptic error message with malformed pants.toml pantsbuild/pants#17848

Basically, specifying

pandas-stubs>=1.5.3<2.0.0

instead of

pandas-stubs>=1.5.3,<2.0.0

as the requirement resolves the version of pandas-stubs to version 2.0.0 instead of version 1.5.3, which was unintended, and the malformed version requirement specification had undesirable effects. It seems that pip silently takes just the lower bound from the specification.

Expected behavior

I expected pip to catch the malformed version requirement specification during validation instead of silently taking just the lower bound.

pip version

20.0.2

Python version

3.8.10

OS

Linux Ubuntu 20.04

How to Reproduce

1. Make a malformed version requirement specification, such as the one described in the description.
2. Use that malformed specification and see that it does not get caught in validation.

Output

No response

Code of Conduct

• I agree to follow the PSF Code of Conduct.

[uranusjr]

#11715