[16.0][FIX] upgrade_analysis: Revert #3707 and do it on test-requirements.txt

[pedrobaeza]

@Tecnativa

[OCA-git-bot]

Hi @StefanRijnhart, @legalsylvain,
some modules you are maintaining are being modified, check this out!

[pedrobaeza]

@StefanRijnhart @sbidoul should I trigger the merge?

[StefanRijnhart]

I'm not sure I agree. I think the previous version would also fix the issue in some production deploys (depending on the method of installation) and in other OCA PRs on other repos that (theoretically) would pull in upgrade_analysis as a dependency.

[sbidoul]

You are right that the same constraint will need to be applied on other OCA repos that depend on upgrade_analysis.

But assume a security vulnerability appears in mako < 1.4. With this you prevent everyone from upgrading, for a bad reason. If you upgrade jinja2 too everything probably works, since the problem seems to come from the old version of jinja2?

It's complicated and I agree this solution is not ideal but its better than the direct upper bound, I'm quite sure of that.

There is a similar issue that pops up frequently with cryptography and openssl, and we apply a similar solution, because forcing everyone to use an old version of the cryptography library is obviously not a good thing to do.

[StefanRijnhart]

@sbidoul Alright, thanks for confirming.

[StefanRijnhart]

/ocabot merge patch

[OCA-git-bot]

This PR looks fantastic, let's merge it!
Prepared branch 16.0-ocabot-merge-pr-3708-by-StefanRijnhart-bump-patch, awaiting test results.

[OCA-git-bot]

Congratulations, your PR was merged at 48086bf. Thanks a lot for contributing to OCA. ❤️