Environment

• pip version: 19.1.1
• Python version: 3.7.2
• OS: KDE Neon

Description

In constraints file, when declaring a package with extras, all the dependencies of it get installed, even if actual requirement does not declare extras.

How to Reproduce

echo "requests[security]==2.20.1" > constraints.txt
pip install -c constraints.txt requests

Output

This installs not only direct requests dependencies:

Installing collected packages: chardet, certifi, idna, urllib3, requests

But also [security] extras:

Installing collected packages: idna, chardet, certifi, urllib3, six, pycparser, cffi, asn1crypto, cryptography, pyOpenSSL, requests

Expected behavior

pip should install only direct dependencies, even if extras are declared in constraints file.

This is such a simple case and easy to reproduce, it must be expected behavior. But why? And where is it documented?