Skip to content

Conversation

mbarrien
Copy link
Contributor

signxml is pinning the max version of several requirements of libraries that have all updated past the max version. This PR upgrades them all.

For a library used in other projects, it may be advisable to remove the max version and let the library user themselves manage the max versions in their own requirements files (and let the library user deal with the conflicts themselves; they're smart enough to figure it out). This will get rid of the need for the PR every time a library upgrades in backwards compatible ways.

@codecov-io
Copy link

codecov-io commented Apr 22, 2017

Codecov Report

Merging #84 into master will not change coverage.
The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##           master      #84   +/-   ##
=======================================
  Coverage   95.32%   95.32%           
=======================================
  Files           3        3           
  Lines         599      599           
=======================================
  Hits          571      571           
  Misses         28       28

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2e0a260...d59a5bf. Read the comment docs.

@kislyuk
Copy link
Member

kislyuk commented Apr 22, 2017

Yes, I think this is a tricky question that ultimately relates to whether the maintainer should do the due diligence of testing before indicating that the new dependency version is safe to use with the maintainer's library (here I'm interpreting major version numbers per the semver standard) or let stuff potentially break and rely on users to sort it out.

@kislyuk kislyuk merged commit 4dfddaa into XML-Security:master Apr 22, 2017
@kislyuk
Copy link
Member

kislyuk commented Apr 22, 2017

See 6529b68. If you want to make the pyasn1 dependency explicit, please open another PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants