Potential dependency conflicts between aws2 and botocore

[NeolithEra]

Hi, as shown in the following full dependency graph of aws2, aws2 requires botocore * ， while the installed version of boto3(1.10.23) requires botocore >=1.13.23,<1.14.0.

According to Pip's “first found wins” installation strategy, botocore 1.13.23 is the actually installed version.

Although the first found package version botocore 1.13.23 just satisfies the later dependency constraint （botocore >=1.13.23,<1.14.0), it will lead to a build failure once developers release a newer version of botocore.

Dependency tree--------

aws2 - 0.2.2
| +- boto3(install version:1.10.23 version range:*)
| | +- botocore(install version:1.13.23 version range:>=1.13.23,<1.14.0)
| | | +- docutils(install version:0.15.2 version range:>=0.10,<0.16)
| | | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| | +- s3transfer(install version:0.2.1 version range:>=0.2.0,<0.3.0)
| | | +- botocore(install version:1.13.23 version range:<2.0.0,>=1.12.36)
| | | | +- docutils(install version:0.15.2 version range:>=0.10,<0.16)
| | | | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| +- botocore(install version:1.13.23 version range:*)
| | +- docutils(install version:0.15.2 version range:>=0.10,<0.16)
| | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| +- fabric(install version:2.5.0 version range:*)
| +- nbextensions(install version:0.1.0 version range:*)
| +- pandas(install version:0.25.3 version range:*)
| +- pyperclip(install version:1.7.0 version range:*)
| +- requests(install version:2.22.0 version range:*)
| | +- certifi(install version:2019.9.11 version range:>=2017.4.17)
| | +- chardet(install version:3.0.4 version range:<3.1.0,>=3.0.2)
| | +- idna(install version:2.8 version range:>=2.5,<2.9)
| | +- urllib3(install version:1.25.7 version range:<1.26,>=1.21.1) 

Thanks for your attention.
Best,
Neolith

[NeolithEra]

Suggested Solution

1. Fix your direct dependencies to be botocore <1.14.0.
2. Ask your upstream project boto3 to lose the version range of _botocore _ to be >=1.13.23, and s3transfer to lose the version range of botocore to be >=1.12.36.

@simonm3 Which solution do you prefer, 1 or 2?
Please let me know your choice. May I pull a request to solve this issue?

[simonm3]

I think better to install with latest versions unless there is a known conflict. If a conflict arises later then pip will warn you and if necessary you can reinstall using latest releases. Not sure what you mean about bleach as that is not a dependency.

…

On Sat, 28 Dec 2019 at 09:40, NeolithEra ***@***.***> wrote: Hi, as shown in the following full dependency graph of *aws2*, *aws2* requires *botocore ** ， while the installed version of *boto3*(1.10.23) requires *botocore >=1.13.23,<1.14.0*. According to Pip's *“first found wins”* installation strategy, *botocore 1.13.23* is the actually installed version. Although the first found package version *botocore 1.13.23* just satisfies the later dependency constraint （*botocore >=1.13.23,<1.14.0*), it will lead to a build failure once developers release a newer version of bleach. Dependency tree-------- aws2 - 0.2.2 | +- boto3(install version:1.10.23 version range:*) | | +- botocore(install version:1.13.23 version range:>=1.13.23,<1.14.0) | | | +- docutils(install version:0.15.2 version range:>=0.10,<0.16) | | | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1) | | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1) | | +- s3transfer(install version:0.2.1 version range:>=0.2.0,<0.3.0) | | | +- botocore(install version:1.13.23 version range:<2.0.0,>=1.12.36) | | | | +- docutils(install version:0.15.2 version range:>=0.10,<0.16) | | | | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1) | +- botocore(install version:1.13.23 version range:*) | | +- docutils(install version:0.15.2 version range:>=0.10,<0.16) | | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1) | +- fabric(install version:2.5.0 version range:*) | +- nbextensions(install version:0.1.0 version range:*) | +- pandas(install version:0.25.3 version range:*) | +- pyperclip(install version:1.7.0 version range:*) | +- requests(install version:2.22.0 version range:*) | | +- certifi(install version:2019.9.11 version range:>=2017.4.17) | | +- chardet(install version:3.0.4 version range:<3.1.0,>=3.0.2) | | +- idna(install version:2.8 version range:>=2.5,<2.9) | | +- urllib3(install version:1.25.7 version range:<1.26,>=1.21.1) Thanks for your attention. Best, Neolith — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#2?email_source=notifications&email_token=AAJE32KK5D4E7K7AQKYGWMLQ24NKFA5CNFSM4KAJ45F2YY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4IC7FKRQ>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJE32KY2DYD2CJGSDJOVYDQ24NKFANCNFSM4KAJ45FQ> .