[GitHub] [airflow] mik-laj commented on issue #12120: Old libraries in setup.py causing dependency resolution to pull old transitive constraints (3 years+)

[GitBox <gi...@apache.org>]

mik-laj commented on issue #12120:
URL: https://github.com/apache/airflow/issues/12120#issuecomment-748632079


   Airflow doesn't use this dependency directly, but other dependencies that require Airflow do require this library. Python doesn't have dependency isolation (for example, [the node has](https://npm.github.io/how-npm-works-docs/npm2/how-npm2-works.html)), so we need to make sure other libraries don't restrict their dependency versions too much, otherwise users won't be able to use their favorite libraries in the latest versions.  Users will also not be able to get security patches if the version restrictions are too restrictive.
   
   ```
   pipdeptree -r -p dnspython
   
   dnspython==1.16.0
     - email-validator==1.1.2 [requires: dnspython>=1.15.0]
       - Flask-AppBuilder==3.1.1 [requires: email-validator>=1.0.5,<2]
         - apache-airflow==2.0.0 [requires: flask-appbuilder~=3.1.1]
     - eventlet==0.29.1 [requires: dnspython>=1.15.0,<2.0.0]
   ```


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org