Potential dependency conflicts between awswl and botocore

[NeolithEra]

Hi, as shown in the following full dependency graph of awswl, awswl requires botocore * ， while the installed version of boto3(1.10.45) requires botocore >=1.13.45,<1.14.0.

According to Pip's “first found wins” installation strategy, botocore 1.13.45 is the actually installed version.

Although the first found package version botocore 1.13.45 just satisfies the later dependency constraint （botocore >=1.13.45,<1.14.0), it will lead to a build failure once developers release a newer version of botocore.

Dependency tree--------

awswl - 1.0.2
| +- boto3(install version:1.10.45 version range:*)
| | +- botocore(install version:1.13.45 version range:>=1.13.45,<1.14.0)
| | | +- docutils(install version:0.15.2 version range:>=0.10,<0.16)
| | | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| | +- s3transfer(install version:0.2.1 version range:>=0.2.0,<0.3.0)
| | | +- botocore(install version:1.13.45 version range:<2.0.0,>=1.12.36)
| | | | +- docutils(install version:0.15.2 version range:>=0.10,<0.16)
| | | | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| +- botocore(install version:1.13.45 version range:*)
| | +- docutils(install version:0.15.2 version range:>=0.10,<0.16)
| | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| +- future(install version:0.18.2 version range:*)
| +- ipaddress(install version:1.0.23 version range:*)
| +- requests(install version:2.22.0 version range:*)
| | +- certifi(install version:2019.9.11 version range:>=2017.4.17)
| | +- chardet(install version:3.0.4 version range:<3.1.0,>=3.0.2)
| | +- idna(install version:2.8 version range:>=2.5,<2.9)
| | +- urllib3(install version:1.25.7 version range:<1.26,>=1.21.1) 

Thanks for your attention.
Best,
Neolith

[NeolithEra]

Suggested Solution

1. Fix your direct dependencies to be botocore <1.14.0.
2. Ask your upstream project boto3 to lose the version range of botocore to be >=1.13.45, and s3transfer to lose the version range of botocore to be >=1.12.36.

@geoffreywiseman Which solution do you prefer, 1 or 2?
Please let me know your choice. May I pull a request to solve this issue?

[geoffreywiseman]

Hey, sorry -- I think I saw this over the year end holidays, thought I'd get back to it after the holidays, and then it got away from me. ;)

Fundamentally, I don't want to be too tied to specific versions, mostly because I don't want other people who are using Boto and awswl for separate things to need to juggle the dependencies (although with venv, maybe not the end of the world, I suppose).

What are you using for the tree? I just tried pipdeptree and got:

pipdeptree -p awswl
awswl==1.0.2
  - boto3 [required: Any, installed: 1.14.20]
    - botocore [required: >=1.17.20,<1.18.0, installed: 1.17.20]
      - docutils [required: >=0.10,<0.16, installed: 0.15.2]
      - jmespath [required: >=0.7.1,<1.0.0, installed: 0.10.0]
      - python-dateutil [required: >=2.1,<3.0.0, installed: 2.8.1]
        - six [required: >=1.5, installed: 1.15.0]
      - urllib3 [required: >=1.20,<1.26, installed: 1.25.9]
    - jmespath [required: >=0.7.1,<1.0.0, installed: 0.10.0]
    - s3transfer [required: >=0.3.0,<0.4.0, installed: 0.3.3]
      - botocore [required: >=1.12.36,<2.0a.0, installed: 1.17.20]
        - docutils [required: >=0.10,<0.16, installed: 0.15.2]
        - jmespath [required: >=0.7.1,<1.0.0, installed: 0.10.0]
        - python-dateutil [required: >=2.1,<3.0.0, installed: 2.8.1]
          - six [required: >=1.5, installed: 1.15.0]
        - urllib3 [required: >=1.20,<1.26, installed: 1.25.9]
  - botocore [required: Any, installed: 1.17.20]
    - docutils [required: >=0.10,<0.16, installed: 0.15.2]
    - jmespath [required: >=0.7.1,<1.0.0, installed: 0.10.0]
    - python-dateutil [required: >=2.1,<3.0.0, installed: 2.8.1]
      - six [required: >=1.5, installed: 1.15.0]
    - urllib3 [required: >=1.20,<1.26, installed: 1.25.9]
  - future [required: Any, installed: 0.18.2]
  - requests [required: Any, installed: 2.24.0]
    - certifi [required: >=2017.4.17, installed: 2020.6.20]
    - chardet [required: >=3.0.2,<4, installed: 3.0.4]
    - idna [required: >=2.5,<3, installed: 2.10]
    - urllib3 [required: >=1.21.1,<1.26,!=1.25.1,!=1.25.0, installed: 1.25.9]

Doesn't see to be causing any conflicts at the moment -- are you still seeing an issue here, or has time healed all wounds?

Sorry that it took so long to get back to you. ;)