search

terricain / aioboto3

Wrapper to use boto3 resources with the aiobotocore async backend
Apache License 2.0
732 stars 75 forks source link

Fixing dependencies prevents their use by other libraries #238

Closed Suor closed 3 years ago

Suor commented 3 years ago

You have deps, like aiobotocore fixed to particular versions, which is not recommended for python libraries only for projects. The reason is if two libraries use the same dep and specify even slightly different versions, e.g. 1.3.2 and 1.3.3, then no code might simultaneously use both libraries without violating their dependencies. Recent versions of pip will even refuse to install such libraries together.

The solution is to specify the most wide version range possible, i.e. aiobotocore>=1.3.3,<2.0. Here we rely on some bugfix in 1.3.3 and do not expect to work after non-backwards compatible change in 2.0.

terricain commented 3 years ago

The problem is, aiobotocore[boto3] depends on a specific version of boto3, of which this library is patching some of the methods, by relaxing that constraint could then result in newer versions of boto3 being pulled in which are incompatible.