Luigi: Is there a reason python-dateutil is pinned to v2.7.5?

[birdcolour]

In this commit, I can see that python-dateutil has been pinned to version 2.7.5 - is this strictly necessary? Version 2.8.0 was released a couple of weeks ago and It's causing ContextualVersionConflict errors for us.

[dlstadther]

@birdcolour Most likely it was the latest version available at the time. Not all projects follow semantic versioning, so where possible we often lock to a specific version.

Feel free to run tests with an updated dateutil version and verify they pass!

[soxofaan]

Same issue/question here.

example to reproduce the warning I am getting:

$ cat setup.py
import setuptools

setuptools.setup(
    name="foobar",
    install_requires=['pandas', 'luigi']
)

$ docker run --rm -it -v $PWD:/app -w /app python:3.7-slim-stretch bash

root@35373e471b55:/app# pip install .
...
Collecting luigi (from foobar==0.0.0)
  Downloading https://files.pythonhosted.org/packages/3c/ac/28a8e7754eb4540bc5c9a3f0c831ea61dd4eae0e99d25345bd9d562f770a/luigi-2.8.3.tar.gz (1.2MB)
...
Collecting python-dateutil>=2.5.0 (from pandas->foobar==0.0.0)
  Downloading https://files.pythonhosted.org/packages/41/17/c62faccbfbd163c7f57f3844689e3a78bae1f403648a6afb1d0866d87fbb/python_dateutil-2.8.0-py2.py3-none-any.whl (226kB)
...
luigi 2.8.3 has requirement python-dateutil==2.7.5, but you'll have python-dateutil 2.8.0 which is incompatible.
...

root@35373e471b55:/app# pip freeze
...
luigi==2.8.3
python-dateutil==2.8.0
...

[soxofaan]

FYI was introduced by https://github.com/spotify/luigi/pull/2601/files/68de9c22f0b0385b5e4117065fdaf8dcb95493c1#diff-2eeaed663bd0d25b7e608891384b7298

IMHO this "securing the software supply chain" is a misguided reason to pin a dependency with == to a specific version (at least for libraries like luigi, for applications the story is the other way) and it will cause more issues than it might solve

[lallea]

Apologies for causing trouble, and thanks for mending.

BTW, I think that it would be wise if a Luigi release that changes a dependency also bumps the minor version number, since it includes a risk of breakage if Luigi is installed together with other Python packages.