Environment variables get expanded by pip-compile. This is especially unwanted when the variable describes a password or local path.

Environment Versions

1. Ubuntu 18.04
2. Python version: 3.7.4
3. pip version: 19.3.1
4. pip-tools version: 4.2.0

Steps to replicate

requirements.in

-e ${MY_PROJECT_DIR}/myapp
-e git+https://${USER}:${PASSWD}@gitserver/myapp.git

Expected result

requirements.txt

-e ${MY_PROJECT_DIR}/myapp
-e git+https://${USER}:${PASSWD}@gitserver/myapp.git#egg=myapp

Actual result

The requirements.txt contains the expanded variables.