Installation fails due to conflicting botocore version

[NeolithEra]

Hi, users are unable to run Dmn-python-lambda due to dependency conflict with botocore package. As shown in the following full dependency graph of Dmn-python-lambda, Dmn-python-lambda requires botocore>=1.5.62,<2.0.0，while boto3==1.4.4 requires botocore>=1.5.0,<1.6.0.

According to pip’s “first found wins” installation strategy, botocore 1.16.16 is the actually installed version. However, botocore 1.16.16 does not satisfy botocore>=1.5.0,<1.6.0.

Dependency tree-----------

dmn-python-lambda - 3.3.1
| +- boto3(install version:1.4.4 version range:==1.4.4)
| | +- botocore(install version:1.5.95 version range:>=1.5.0,<1.6.0)
| | | +- docutils(install version:0.14 version range:>=0.10)
| | | +- jmespath(install version:0.9.5 version range:<1.0.0,>=0.7.1)
| | | +- python-dateutil(install version:2.7.5 version range:>=2.1,<3.0.0)
| | | | +- six(install version:1.11.0 version range:*)
| | | | +- six(install version:1.11.0 version range:>=1.5)
| | +- jmespath(install version:0.9.5 version range:<1.0.0,>=0.7.1)
| | +- s3transfer(install version:0.1.13 version range:>=0.1.10,<0.2.0)
| | | +- botocore(install version:1.16.19 version range:>=1.3.0,<2.0.0)
| +- botocore(install version:1.16.19 version range:>=1.5.62,<2.0.0)
| +- click(install version:6.6 version range:==6.6)
| +- docutils(install version:0.14 version range:<0.15,>=0.12)
| +- futures(install version:3.3.0 version range:*)
| +- jmespath(install version:0.9.5 version range:>=0.9.0,<0.10.0)
| +- pyaml(install version:15.8.2 version range:==15.8.2)
| | +- pyyaml(install version:3.13 version range:*)
| +- python-dateutil(install version:2.7.5 version range:<2.8.0,>=2.5.3)
| | +- six(install version:1.11.0 version range:*)
| | +- six(install version:1.11.0 version range:>=1.5)
| +- pyyaml(install version:3.13 version range:>=3.11,<3.14)
| +- six(install version:1.11.0 version range:<1.12.0,>=1.10.0)

Thanks for your help.
Best,
Neolith

[NeolithEra]

Solution

1. Loosen the version range of boto3 to be >=1.4.4.
2. Remove your direct dependency botocore, and use the botocore transitively introduced by boto3.
3. Loosen the version range of botocore to be >=1.5.62,<1.6.0.
   @nficano Which solution do you prefer, 1 ,2 or 3?
   Please let me know your choice. May I pull a request to solve this issue?

[zacharyabresch]

I'm also having this issue.

[zacharyabresch]

Is anyone working on this? I believe I can't use Secrets Manager due to this and can't find a way to install the correct versions myself. Would rather not fork.

[zacharyabresch]

Or has anyone found a workaround?

[zacharyabresch]

BTW, I cloned this and did 1 & 2 from @NeolithEra 's post and worked without issue.

[zacharyabresch]

Well, I attempted to push a branch for a pull request but I don't have permission (of course). This is really frustrating. I understand this is open-source so I'm not bitching. It would just be nice to get this fixed with such a simple change. There are also a bunch of PRs from Dependabot awaiting review so not sure how active the maintainer will be.

[zacharyabresch]

Okay, well, 5 days with no response. That's worrisome to say the least. Guess I'll have to start looking for a new tool or build my own.

[NeolithEra]

@zacharyabresch Sorry for my late reply. Generally, it is an automated tool (implemented as a bot on GitHub https://github.com/apps/watchman-pypi ). But there are administrators looking at your comments. : p
Welcome to try this dependency conflict diagnosis tool for your Python projects.

[cole-seph]

Plus one on this issue

[rishabh-bhargava]

Found some time to fix this (#534 ) - followed bullet points 1 and 2 from the solution mentioned earlier (thanks @NeolithEra). Please use the latest version: python-lambda==11.8.0, which should allow for more up-to-date boto3 and botocore versions.

If you run into any issues, please let me know - happy to push additional fixes as needed.

Solution

1. Loosen the version range of boto3 to be >=1.4.4.
2. Remove your direct dependency botocore, and use the botocore transitively introduced by boto3.
3. Loosen the version range of botocore to be >=1.5.62,<1.6.0.
   @nficano Which solution do you prefer, 1 ,2 or 3?
   Please let me know your choice. May I pull a request to solve this issue?