feat: remove upper bounds on runtime dependencies

[kukushking]

Feature or Bugfix

• Feature

Detail

Removing upper version bounds in runtime dependencies in the AWS SDK for pandas (awswrangler).

Open constraints are especially important for SDK that typically sit at the root of dependency tree and are used in many different environments with different configurations. Being able to install and update dependency versions without conflict is important for SDK users, especially when consuming new functionality of dependencies (pandas, numpy, pyarrow, etc) or security patches.

Conservative approach to upper bound dependencies guarantees safe library/SDK operation but limits its use and introduces significant maintenance burden. This burden may be acceptable for SDK\libraries with small number of dependencies (e.g. boto3) where each dependency can be reviewed and tested prior to upgrade, but grows exponentially with the number of dependencies making it impossible to test for every possible change. Realistically, the same test harness is often ran, that does not test for individual changes in dependencies, and it is unlikely to catch issues with that particular dependency until the user reports it. This results in hiding and delaying discovering issues and slowing down development process. Additionally, this introduces churn to update the bounds when nothing actually broke or changed.

With this change, we suggest to remove upper bounds and rely on user reports to discover potential issues in dependencies. We fully acknowledge this change may impact the number of reports about potential dependency incompatibilities and breaking changes in dependencies. After careful consideration, based on development effort estimation and severity of the issue, we may introduce upper bounds only on dependencies where it’s actually needed.

Suggested approach:

• Keep lower bounds to specify minimum tested versions
• Remove upper bounds to allow forward compatibility
• Address actual incompatibilities when they occur through testing and bug reports
• Use deprecation warnings to prepare for future changes
• This change aligns with recommendations from Python core developers and PyPA maintainers, making awswrangler a better citizen in the Python ecosystem

Reference

• https://iscinumpy.dev/post/bound-version-constraints/

Relates

• Can't install 3.14 on Python 3.14 #3235 (comment)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[jaidisido]

AWS CodeBuild CI Report

• CodeBuild project: GitHubCodeBuild8756EF16-4rfo0GHQ0u9a
• Commit ID: a2ffe7b
• Result: FAILED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[jaidisido]

AWS CodeBuild CI Report

• CodeBuild project: GitHubDistributedCodeBuild6-jWcl5DLmvupS
• Commit ID: a2ffe7b
• Result: FAILED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository