stripe-python Duplicate requests dependency (causes issues

The Fix

pip install stripe==14.4.0a2

Based on closed stripe/stripe-python issue #447 · PR/commit linked

Production note: This usually shows up under retries/timeouts. Treat it as a side-effect risk until you can verify behavior with a canary + real traffic.

Jump to Verify Open PR/Commit

@@ -44,7 +44,7 @@ def run_tests(self):
     zip_safe=False,
     install_requires=[
-        'requests >= 2',
+        'requests >= 2; python_version >= "3.0"',
         'requests[security] >= 2; python_version < "3.0"',

repro.py

Traceback (most recent call last):
  File "runtests.py", line 210, in <module>
    main()
  File "runtests.py", line 27, in main
    run_test_suite(args)
  File "runtests.py", line 152, in run_test_suite
    django.setup()
  File "/home/adys/src/HearthSim/dj-stripe/.tox/py27-django111/lib/python2.7/site-packages/django/__init__.py", line 27, in setup
    apps.populate(settings.INSTALLED_APPS)
  File "/home/adys/src/HearthSim/dj-stripe/.tox/py27-django111/lib/python2.7/site-packages/django/apps/registry.py", line 85, in populate
    app_config = AppConfig.create(entry)
  File "/home/adys/src/HearthSim/dj-stripe/.tox/py27-django111/lib/python2.7/site-packages/django/apps/config.py", line 94, in create
    module = import_module(entry)
  File "/usr/lib64/python2.7/importlib/__init__.py", line 37, in import_module
    __import__(name)
  File "/home/adys/src/HearthSim/dj-stripe/djstripe/__init__.py", line 12, in <module>
    __version__ = pkg_resources.require("dj-stripe")[0].version
  File "/home/adys/src/HearthSim/dj-stripe/.tox/py27-django111/lib/python2.7/site-packages/pkg_resources/__init__.py", line 891, in require
    needed = self.resolve(parse_requirements(requirements))
  File "/home/adys/src/HearthSim/dj-stripe/.tox/py27-django111/lib/python2.7/site-packages/pkg_resources/__init__.py", line 777, in resolve
    raise DistributionNotFound(req, requirers)
pkg_resources.DistributionNotFound: The 'cryptography>=1.3.4; extra == "security"' distribution was not found and is required by requests

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

fix.md

Option A — Upgrade to fixed release\npip install stripe==14.4.0a2\nWhen NOT to use: This fix is not applicable if the project requires both requests dependencies for different Python versions.\n\n

Why This Fix Works in Production

Trigger: main()
Mechanism: Avoids duplicate dependency on requests, which was causing issues with pip on Python 2.7.
Why the fix works: Avoids duplicate dependency on requests, which was causing issues with pip on Python 2.7. (first fixed release: 14.4.0a2).

Production impact:

If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.

Why This Breaks in Prod

Shows up under Python 2.0 in real deployments (not just unit tests).
Surfaces as: Traceback (most recent call last):

Proof / Evidence

GitHub issue: #447
Fix PR: https://github.com/stripe/stripe-python/pull/448
First fixed release: 14.4.0a2
Reproduced locally: No (not executed)
Last verified: 2026-02-08
Confidence: 0.85
Did this fix it?: Yes (upstream fix exists)
Own content ratio: 0.26

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

Jump to Sources Open on GitHub

“After the stripe-python 2.0 upgrade, dj-stripe's tests on Python 2.7 started failing and I've been trying to investigate why. The error is a little absurd: Using pipdeptree however, we can see that stripe specifies the requests dependency t”

Issue thread · issue description · source

Failure Signature (Search String)

main()

Error Message

Stack trace

error.txt

Error Message
-------------
Traceback (most recent call last):
  File "runtests.py", line 210, in <module>
    main()
  File "runtests.py", line 27, in main
    run_test_suite(args)
  File "runtests.py", line 152, in run_test_suite
    django.setup()
  File "/home/adys/src/HearthSim/dj-stripe/.tox/py27-django111/lib/python2.7/site-packages/django/__init__.py", line 27, in setup
    apps.populate(settings.INSTALLED_APPS)
  File "/home/adys/src/HearthSim/dj-stripe/.tox/py27-django111/lib/python2.7/site-packages/django/apps/registry.py", line 85, in populate
    app_config = AppConfig.create(entry)
  File "/home/adys/src/HearthSim/dj-stripe/.tox/py27-django111/lib/python2.7/site-packages/django/apps/config.py", line 94, in create
    module = import_module(entry)
  File "/usr/lib64/python2.7/importlib/__init__.py", line 37, in import_module
    __import__(name)
  File "/home/adys/src/HearthSim/dj-stripe/djstripe/__init__.py", line 12, in <module>
    __version__ = pkg_resources.require("dj-stripe")[0].version
  File "/home/adys/src/HearthSim/dj-stripe/.tox/py27-django111/lib/python2.7/site-packages/pkg_resources/__init__.py", line 891, in require
    needed = self.resolve(parse_requirements(requirements))
  File "/home/adys/src/HearthSim/dj-stripe/.tox/py27-django111/lib/python2.7/site-packages/pkg_resources/__init__.py", line 777, in resolve
    raise DistributionNotFound(req, requirers)
pkg_resources.Distr
... (truncated) ...

Minimal Reproduction

repro.py

Traceback (most recent call last):
  File "runtests.py", line 210, in <module>
    main()
  File "runtests.py", line 27, in main
    run_test_suite(args)
  File "runtests.py", line 152, in run_test_suite
    django.setup()
  File "/home/adys/src/HearthSim/dj-stripe/.tox/py27-django111/lib/python2.7/site-packages/django/__init__.py", line 27, in setup
    apps.populate(settings.INSTALLED_APPS)
  File "/home/adys/src/HearthSim/dj-stripe/.tox/py27-django111/lib/python2.7/site-packages/django/apps/registry.py", line 85, in populate
    app_config = AppConfig.create(entry)
  File "/home/adys/src/HearthSim/dj-stripe/.tox/py27-django111/lib/python2.7/site-packages/django/apps/config.py", line 94, in create
    module = import_module(entry)
  File "/usr/lib64/python2.7/importlib/__init__.py", line 37, in import_module
    __import__(name)
  File "/home/adys/src/HearthSim/dj-stripe/djstripe/__init__.py", line 12, in <module>
    __version__ = pkg_resources.require("dj-stripe")[0].version
  File "/home/adys/src/HearthSim/dj-stripe/.tox/py27-django111/lib/python2.7/site-packages/pkg_resources/__init__.py", line 891, in require
    needed = self.resolve(parse_requirements(requirements))
  File "/home/adys/src/HearthSim/dj-stripe/.tox/py27-django111/lib/python2.7/site-packages/pkg_resources/__init__.py", line 777, in resolve
    raise DistributionNotFound(req, requirers)
pkg_resources.DistributionNotFound: The 'cryptography>=1.3.4; extra == "security"' distribution was not found and is required by requests

Environment

Python: 2.0

What Broke

Tests for dj-stripe fail due to missing cryptography dependency caused by duplicate requests.

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

pip install stripe==14.4.0a2

When NOT to use: This fix is not applicable if the project requires both requests dependencies for different Python versions.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Option D — Guard side-effects with OnceOnly Guardrail for side-effects

Mitigate duplicate external side-effects under retries/timeouts/agent loops by gating the operation before calling external systems.

Place OnceOnly between your code/agent and real side-effects (Stripe, emails, CRM, APIs).
Use a stable key per side-effect (e.g., customer_id + action + idempotency_key).
Fail-safe: configure fail-open vs fail-closed based on blast radius and spend risk.

Show example snippet (optional)

onceonly.py

from onceonly import OnceOnly
import os

once = OnceOnly(api_key=os.environ["ONCEONLY_API_KEY"], fail_open=True)

# Stable idempotency key per real side-effect.
# Use a request id / job id / webhook delivery id / Stripe event id, etc.
event_id = "evt_..."  # replace
key = f"stripe:webhook:{event_id}"

res = once.check_lock(key=key, ttl=3600)
if res.duplicate:
    return {"status": "already_processed"}

# Safe to execute the side-effect exactly once.
handle_event(event_id)

See OnceOnly SDK

When NOT to use: Do not use this to hide logic bugs or data corruption. Use it to block duplicate external side-effects and enforce tool permissions/spend caps.

Fix reference: https://github.com/stripe/stripe-python/pull/448

First fixed release: 14.4.0a2

Last verified: 2026-02-08. Validate in your environment.

When NOT to Use This Fix

This fix is not applicable if the project requires both requests dependencies for different Python versions.
Do not use this to hide logic bugs or data corruption. Use it to block duplicate external side-effects and enforce tool permissions/spend caps.

Verify Fix

verify

Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

Capture the exact failing error string in logs and tests so you can reproduce via a minimal script.
Pin production dependencies and upgrade only with a reproducible test that hits the failing path.

Version Compatibility Table

Version	Status
14.4.0a2	Fixed

Related Issues

No related fixes found.

Cluster: stripe-python:configuration-error stripe-python hub stripe-python best practices All hubs All clusters

Related clusters: Data consistency Other Payments

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.

stripe-python Duplicate requests dependency (causes issues on Python 2) (Fix)