Skip to content

Release 1.30.0 is no longer compatible with all but three releases of boto3 #1809

@javulticat

Description

@javulticat

Description:

The latest version of boto3 is (currently) 1.16.21.

With the 1.30.0 release of this library created today, the boto3 requirement is now pinned to ~=1.15.16 (relevant PR: #1762). Note that ~=1.15.16 is equivalent to >=1.15.16, < 1.16, which means that all 1.16.* versions of boto3 are now deemed to be incompatible with version 1.30.0 of this library by dependency resolution tools. In fact, there are exactly three boto3 releases that match this criteria:

  • 1.15.16
  • 1.15.17
  • 1.15.18

Prior to this change, the boto3 requirement in this library was pinned to ~=1.5, which is equivalent to >=1.5, < 2, which allowed 1.16.* versions as well as hundreds of older releases of boto3 to fill that dependency without issue. And, indeed, we have several projects which have successfully used 1.16.* versions of boto3 since they were first released on Oct 19, 2020 until today with this library (albeit with versions < 1.30.0) without any problems. And, prior to the release of 1.15.16, we used versions of boto3 older than 1.15.16 alongside this library for many months, similarly without issue.

So, I am left wondering whether the 1.30.0 release is truly incompatible with all boto3 versions except for 1.15.16, 1.15.17, and 1.15.18, or whether the pinned boto3 requirement is a mistake?

Steps to reproduce the issue:

  1. Use your favorite dependency resolution tool to try to resolve dependencies that include aws-sam-translator==1.30.0 and any version of boto3 other than the 3 mentioned above
  2. Try to resolve dependencies
  3. Get errors

Example using pipenv:

Pipfile:

[[source]]
name = "pypi"
url = "https://pypi.org/simple"
verify_ssl = true

[packages]
aws-sam-translator = "==1.30.0"
boto3 = "==1.16.21"

When running pipenv lock to resolve dependencies...

Observed result:

ERROR: Could not find a version that matches boto3==1.16.21,~=1.15.16 (from -r /var/folders/l5/dzcvhz211hqg0hk2jsr_2j380000gn/T/pipenvfcw532j5requirements/pipenv-towbqkne-constraints.txt (line 3))
There are incompatible versions in the resolved dependencies:
  boto3==1.16.21 (from -r /var/folders/l5/dzcvhz211hqg0hk2jsr_2j380000gn/T/pipenvfcw532j5requirements/pipenv-towbqkne-constraints.txt (line 3))
  boto3~=1.15.16 (from aws-sam-translator==1.30.0->-r /var/folders/l5/dzcvhz211hqg0hk2jsr_2j380000gn/T/pipenvfcw532j5requirements/pipenv-towbqkne-constraints.txt (line 2))

Expected result:

✔ Success!
Updated Pipfile.lock (4010de)!

Metadata

Metadata

Assignees

No one assigned

    Labels

    area/dependenciesPull requests that update a dependency file

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions