{Packaging} Add msal-extensions dependency

[jiasli]

Description

Even though azure-identity depends on msal-extensions and azure-cli depends on azure-identity:

> pipdeptree -r -p msal-extensions
msal-extensions==0.3.0
  - azure-identity==1.6.1 [requires: msal-extensions~=0.3.0]
    - azure-cli==2.29.0 [requires: azure-identity]

azure-cli should declare the direct dependency on msal-extensions as msal-extensions is directly used by azure-cli.

[jiasli]

- < =

[jiasli]

In ASCII, - appears before >, so alphabetically msal-extensions>=0.3.0 is smaller than msal>=1.15.0,<2.0.0.

[rayluo]

You folks sort dependency alphabetically? Interesting. I am not aware that practice, but it sounds good. But I would assume the sorting should only compare the package name (i.e. msal < msal-extensions), not the entire versioning condition (i.e. msal>... < msal-extensions...).

Just my random thoughts. You can ignore this comment. :-)

[jiasli]

In deed, sorting by package name is better, but is is hard to do with an IDE.

As the dependencies of Azure CLI are too many, not soring them will frequently cause merging conflicts.

[rayluo]

Will you consider adding an upper bound such as msal-extensions>=0.3.0,<1, or strictly speaking, msal-extensions>=0.3.0,<0.4?

[jiasli]

That depends on whether msal-extensions will make a breaking change in 1.0 or 0.4. I can't predict the future. 😉

[rayluo]

OK. My point was you would want to at least use some upper bound, rather than no upper bound at all. I think you can go with extensions>=0.3.0,<0.4, for now.

[jiasli]

Actually, recently we deliberately removed upper bound for some libraries like cryptography (#19639) so that users can always use the latest versions of dependencies, rather than waiting for us to bump it. Since pip is being more strict than before, setting a wider version range helps eliminate dependency conflicts.

[rayluo]

msal and msal-extensions use Semantic Versioning. And the whole point of Semantic Versioning (i.e. Why Semantic Versioning) is to be able to:

• precisely setting a lower bound (which is also the idea discussed in {Packaging} Bump cryptography from 2.8 to 3.3.2 #15687 (comment));
• confidently setting an upper bound for a future version yet without worrying about breaking change.

So, I would still suggest you to properly set both lower and upper bounds for msal and msal-extensions.

cryptography is a different story. It does not use SemVer, so its practice is vastly different. It is off-topic in this context. We can follow up offline separately.

[yonzhan]

Packaging

[rayluo]

LGTM