* Fix pip package name matching in downgrade guards
* Apply the pip blacklists however a requirement is written
Build on the name normalization to close the other ways a listed
requirement escaped the pip_blacklist and downgrade_blacklist checks.
- Parse requirements with packaging and share one parser and one
downgrade decision between both cores, the startup check and the
unified resolver
- Treat '-', '_' and '.' as one separator in package names
- Read every version clause, so a lower bound written first no longer
hides an upper bound; read spaces, parentheses, markers, '===' and
direct references; compare local and four-part versions
- Install a requirement with extras unless it would downgrade the
protected package
- Check the requirement of every pip install command form, including
those with --index-url, on the immediate and reserved paths
- Skip a protected package when the requirement cannot be compared and
log why and how to install it
- At startup, recognize an installed package however its requirement
spells the name, and upgrade one older than its '~=' version
- Remove the unused is_installed copies from both cores
- Add regression tests; update README, CHANGELOG and the resolver design
---------
Co-authored-by: Annika Zhang <287326049+annikazhang77@users.noreply.github.com>
Co-authored-by: Dr.Lt.Data <dr.lt.data@gmail.com>
