pandas-stubs conda package does not declare correct dependency constraint on pandas

[connortann]

Describe the bug

We found that these two packages were incorrectly resolved by as compatible packages, and were installed in the same environment:

- conda: https://conda.anaconda.org/conda-forge/linux-64/pandas-2.3.3-py311hed34c8f_2.conda
- conda: https://conda.anaconda.org/conda-forge/noarch/pandas-stubs-3.0.0.260204-pyhd8ed1ab_1.conda

My understanding is that the stubs library should always match the pandas version, so it seems the conda package for pandas-stubs does not correctly declare its constraints.

We use pixi to resolve dependencies. Here's the lockfile entry for pandas-stubs for 3.0.0:

- conda: https://conda.anaconda.org/conda-forge/noarch/pandas-stubs-3.0.0.260204-pyhd8ed1ab_1.conda
  sha256: 4afe6e745cd39f693a2b9f63108b4b47498926e8f94be4301a1b7e80dcfa8631
  md5: 456c66b7d3ff9c5b70a7f234d038fb02
  depends:
  - numpy >=1.26.0
  - python >=3.11
  - types-pytz >=2022.1.1
  license: BSD-3-Clause
  license_family: BSD
  purls:
  - pkg:pypi/pandas-stubs?source=hash-mapping
  size: 106385
  timestamp: 1770304470040

Notably, this is missing a contraint on pandas.

For comparison, here is the lockfile entry for scipy-stubs, which declares an appropriate constraint on scipy:

- conda: https://conda.anaconda.org/conda-forge/noarch/scipy-stubs-1.17.0.2-pyhcf101f3_0.conda
  sha256: 496c6ec60f6fd1fb78b1c66d7532beffcbd5f6c1f9563292ee2f04a7ab9a071c
  md5: b4daacd06a26988b43abd71a31c765af
  depends:
  - python >=3.11
  - optype-numpy >=0.14.0,<0.16.0
  - python
  constrains:
  - scipy >=1.17.0,<1.18.0
  license: BSD-3-Clause
  license_family: BSD
  purls:
  - pkg:pypi/scipy-stubs?source=hash-mapping
  size: 358037
  timestamp: 1769111778658

To Reproduce

Creating a new env resolves pandas 2.3 but pandas-stubs 3.x:

pixi add pandas=2.3 pandas-stubs

[loicdiridollou]

Hey @connortann, thanks for the report!
@Dr-Irv @cmp0xff would this be linked to the fact that in the pyproject config the pandas constraint is in the dev group and not the main dependencies group?