Potential dependency conflicts between swag-client and jmespath

[NeolithEra]

Hi, as shown in the following full dependency graph of swag-client, swag-client requires jmespath (>=0.9.3)， while the installed version of _boto3 _(1.12.39) requires jmespath>=0.7.1,<1.0.0.

According to Pip's “first found wins” installation strategy, jmespath 0.9.5 is the actually installed version.

Although the first found package version jmespath 0.9.5 just satisfies the later dependency constraint （jmespath>=0.7.1,<1.0.0), it will lead to a build failure once developers release a newer version of jmespath.

Dependency tree--------

swag-client  -3.0.0
| +- boto3(install version:1.12.39 version range:>=1.3.7)
| | +- botocore(install version:1.15.49 version range:>=1.15.39,<1.16.0)
| | +- jmespath(install version:0.9.5 version range:>=0.7.1,<1.0.0)
| | +- s3transfer(install version:0.3.3 version range:>=0.3.0,<0.4.0)
| | | +- botocore(install version:1.15.49 version range:>=1.12.36,<2.0a.0)
| +- click(install version:7.1.1 version range:>=6.7)
| +- click-log(install version:0.3.2 version range:>=0.2.1)
| | +- click(install version:7.1.1 version range:*)
| +- deepdiff(install version:4.3.2 version range:>=3.3.0)
| | +- ordered-set(install version:3.1.1 version range:>=3.1.1)
| +- dogpile-cache(install version:0.9.0 version range:>=0.6.4)
| | +- decorator(install version:4.4.2 version range:>=4.0.0)
| +- jmespath(install version:0.9.5 version range:>=0.9.3)
| +- marshmallow(install version:2.21.0 version range:>=3.5.0)
| +- retrying(install version:1.3.3 version range:>=1.3.3)
| | +- six(install version:1.14.0 version range:>=1.7.0)
| +- simplejson(install version:3.17.0 version range:>=3.16.0)
| +- tabulate(install version:0.8.7 version range:>=0.7.7)

Thanks for your attention.
Best,
Neolith

[NeolithEra]

Solution

1. Loosen the version range of jmespath to be >=0.9.3,<=0.9.5.
2. Remove your direct dependency jmespath, and use the jmespath transitively introduced by boto3.
3. Ask your direct dependency boto3 to loosen the version range of jmespath to be >=0.7.1.

@kevgliss Which solution do you prefer, 1 ,2 or 3?
Please let me know your choice. May I pull a request to solve this issue?

[NeolithEra]

@josagonzalez,Could you help me review this issue? Thx :p

[josagonzalez]

@NeolithEra, Thanks for bringing this up! I would prefer #2 or #1 for this.