Potential dependency conflicts between acli and botocore

[NeolithEra]

Hi, as shown in the following full dependency graph of acli, acli requires botocore (>=1.4.39)， while the installed version of boto3(1.12.39) requires botocore>=1.15.39,<1.16.0.

According to Pip's “first found wins” installation strategy, botocore 1.15.39 is the actually installed version.

Although the first found package version botocore1.15.39 just satisfies the later dependency constraint （botocore >=1.15.39,<1.16.0), it will lead to a build failure once developers release a newer version of botocore.

Dependency tree--------

acli - 0.1.34
| +- boto3(install version:1.12.39 version range:>=1.3.1)
| | +- botocore(install version:1.15.39 version range:>=1.15.39,<1.16.0)
| | | +- docutils(install version:0.15.2 version range:>=0.10,<0.16)
| | | +- jmespath(install version:0.10.0 version range:>=0.7.1,<1.0.0)
| | | +- python-dateutil(install version:2.8.1 version range:>=2.1,<3.0.0)
| | | +- urllib3(install version:1.25.9 version range:>=1.20,<1.26)
| | +- jmespath(install version:0.10.0 version range:>=0.7.1,<1.0.0)
| | +- s3transfer(install version:0.3.3 version range:>=0.3.0,<0.4.0)
| | | +- botocore(install version:1.15.39 version range:>=1.12.36,<2.0a.0)
| | | | +- docutils(install version:0.15.2 version range:>=0.10,<0.16)
| | | | +- jmespath(install version:0.10.0 version range:>=0.7.1,<1.0.0)
| | | | +- python-dateutil(install version:2.8.1 version range:>=2.1,<3.0.0)
| | | | +- urllib3(install version:1.25.9 version range:>=1.20,<1.26)
| +- botocore(install version:1.15.39 version range:>=1.4.39)
| | +- docutils(install version:0.15.2 version range:>=0.10,<0.16)
| | +- jmespath(install version:0.10.0 version range:>=0.7.1,<1.0.0)
| | +- python-dateutil(install version:2.8.1 version range:>=2.1,<3.0.0)
| | +- urllib3(install version:1.25.9 version range:>=1.20,<1.26)
| +- colorclass(install version:2.2.0 version range:>=2.2.0)
| +- docopt(install version:0.6.2 version range:>=0.6.2)
| +- humanize(install version:2.3.0 version range:>=0.5.1)
| +- requests(install version:2.23.0 version range:*)
| | +- certifi(install version:2020.4.5.1 version range:>=2017.4.17)
| | +- chardet(install version:3.0.4 version range:>=3.0.2,<4)
| | +- idna(install version:2.9 version range:>=2.5,<3)
| | +- urllib3(install version:1.25.9 version range:>=1.21.1,<1.26)
| +- terminaltables(install version:3.1.0 version range:>=3.0.0)

Thanks for your attention.
Best,
Neolith

[NeolithEra]

Solution

1. Loosen the version range of botocore to be _<= 1.15.39, >=1.4.39 _.
2. Remove your direct dependency botocore, and use the botocore transitively introduced by boto3.

@jonhadfield Which solution do you prefer, 1 or 2?
Please let me know your choice. May I pull a request to solve this issue?

[NeolithEra]

@jonhadfield，Could you help me review this issue? Thx :p