Please update pinned versions

[edrozenberg]

AWS CLI is unique on my system in pinning many things to specific versions, and pinning them to versions that are very old and no longer in common usage by "most people". I tested just now with the latest aws cli versions available.

And in particular from a security standpoint, pinning versions for security packages like cryptography and rsa opens security holes if they cannot be upgraded to always be current.

Would be great to see AWS CLI remove the pins because they create ongoing, irresolvable conflicts.

awscli==2.1.26

 - colorama [required: >=0.2.5,<0.4.4, installed: 0.4.4]
 - docutils [required: >=0.10,<0.16, installed: 0.16]
 - cryptography [required: >=2.8.0,<=2.9.0, installed: 3.4.4]
 - ruamel.yaml [required: >=0.15.0,<0.16.0, installed: 0.16.12]
 - wcwidth [required: <0.2.0, installed: 0.2.5]
 - prompt-toolkit [required: >=2.0.0,<3.0.0, installed: 3.0.16]

awscli==1.19.7

 - docutils [required: >=0.10,<0.16, installed: 0.16]
 - PyYAML [required: >=3.10,<5.4, installed: 5.4.1]
 - colorama [required: >=0.2.5,<0.4.4, installed: 0.4.4]
 - rsa [required: >=3.1.2,<=4.5.0, installed: 4.7]

[kdaily]

Hi @edrozenberg,

Thanks for your comment. We will continue to be conservative with version ranges and won't be removing the ceiling by default. This is to be sure that we maintain backwards compatibility as much as possible, and we have the chance to review any interface changes to the dependencies.

However, we can improve the process for raising the ceiling when new versions become available. It would be a nice feature to get notified on new dependency versions and automatically run interface testing on them so that we can respond to these changes more quickly. For the time being, if you have specific packages that you feel that need to be bumped up, please file an issue for them and describe the conflicts that you're getting with them.

[edrozenberg]

@kdaily thanks, maybe the common usage is to dedicate a machine or VM to be the "aws cli" machine, because the pinned versions of the aws cli reqs can prevent running other packages that require newer versions on the same machine.

[weddige]

I would really appreciate, if you could update colorama and cryptography. If you don't want to remove the ceiling, you maybe could unpin the minor versions.

[kdaily]

@weddige, we're looking into updating cryptography, but the introduction of a Rust dependency has made this more involved. There is an open PR for bumping colorama, but it still needs review as well.

[dconathan]

👍 for me on this issue... right now I can't install the latest schemathesis and awscli in the same environment...

ERROR: Could not find a version that matches colorama<0.4.4,<0.5.0,>=0.2.5,>=0.4.4
...
colorama<0.4.4,>=0.2.5 (from awscli==1.20.36)
colorama<0.5.0,>=0.4.4 (from schemathesis==3.9.7)

[Stranger6667]

@dconathan
On the Schemathesis side, 0.4.4 is not a hard requirement - I can surely relax it for the next release

[alex]

@kdaily I'm one of the maintainers of pyca/cryptography and we're interested in seeing what can be done to get the version cap bumped here. Since our first release with Rust we've made a number of improvements that should help users out: We ship wheels on more platforms (notably musllinux, arm64+universal2 for macOS), lowered our MSRV, and improved the output when compilation fails. Hopefully all of this makes it more tractable to increase the version cap. Thanks!

[nateprewitt]

Thanks for checking in @alex! We had originally paused this waiting for the Rust migration to play out and I think it slipped off the radar. I'll bring this up with the team and see if we can start getting this prioritized.

[alex]

Awesome! If there's more we can be doing, let us know

[nanonyme]

Any chance also updating the docutils dependency? Docutils versions supported by awscli no longer build with setuptools 60.

[kdaily]

@nanonyme,

There's an open PR (#6011) to do this, but it's blocked by some required work for the current documentation pages. I don't have a timeline on when it will get resolved right now.