How can I ban a package from being added to Pipenv.lock and installed by Pipenv?

There are two packages which provide a module named jsonfield:

Unfortunately, we have dependencies which depend on both and the two packages, while interchangable, store data to the database differently. This leads to weird and hard to catch bugs. Also, unfortunately, Pipenv doesn't have any deterministic order of operations when installing dependencies. Sometimes django-jsonfield is installed and sometimes jsonfield is installed. This means that sometimes, randomly, our application breaks because jsonfield is installed instead of django-jsonfield.

Is there a way that I can ban django-jsonfield from being added to Pipenv.lock so that only jsonfield will be installed?

Solution

From the looks of it, you are in quite a tricky situation... There is no clean solution that I know of currently other than manually editing your Pipfile.lock after each time it is generated.

You really should talk to the developers of the culprit projects:

Either jsonfield and django-jsonfield should agree on different names for their top level packages.
Or the projects that depend on jsonfield or django-jsonfield should agree on one of the two and ditch the other one.

You might be interested in this discussion and eventually weigh in: https://github.com/pypa/packaging-problems/issues/154. Of particular interest in your case is the fact that pip allows the overwriting of an already installed package when installing a new one.

Untested:

You could experiment with setting an unlikely marker on the unwanted dependency:

django-jsonfield = { markers="python_version < '2'" }