Running pip in --require-hashes mode proves to be more and more of a nuisance in a large project that I've been working on, as it forces me to specify exact version of every dependency that I'm using. I haven't specified this requiremenent explicitly and was puzzled by its appearance in my logs; after some digging, I found out that the --require-hashes mode is implicitly turned on whenever any dependency install its own requirements with this flag:
Hashes are required in --require-hashes mode (implicitly on when a hash is
specified for any package).
How can I check whcih dependency requires hashes so that I can try to replace it? Alternatively, is there any other workaround for this that I'm not aware of?
EDIT: I'm using pip 21.3.1.
My error message is:
Collecting text-unidecode>=1.3 ERROR: In --require-hashes mode, all requirements must have their versions pinned with ==. These do not: text-unidecode>=1.3 from https://files.pythonhosted.org/packages/a6/a5/c0b6468d3824fe3fde30dbb5e1f687b291608f9473681bbf7dabbf5a87d7/text_unidecode-1.3-py2.py3-none-any.whl#sha256=1311f10e8b895935241623731c2ba64f4c455287888b18189350b67134a822e8 (from python-slugify==4.0.1->-r requirements.txt (line 484))
However, it seems like python-slugify was a dependency of my project long before this became an issue.