Potential dependency conflicts between aws-infrastructure-sdk and botocore

[NeolithEra]

Hi, as shown in the following full dependency graph of aws-infrastructure-sdk, aws-infrastructure-sdk requires botocore * ， while the installed version of boto3(1.10.23) requires botocore >=1.13.23,<1.14.0.

According to Pip's “first found wins” installation strategy, botocore 1.13.23 is the actually installed version.

Although the first found package version botocore 1.13.23 just satisfies the later dependency constraint （botocore >=1.13.23,<1.14.0), it will lead to a build failure once developers release a newer version of botocore.

Dependency tree--------

aws-infrastructure-sdk - 2.1.0
| +- aws-cf-custom-resources(install version:1.0.2 version range:*)
| | +- aws-lambda(install version:1.0.0 version range:*)
| | | +- boto3(install version:1.10.23 version range:*)
| | | | +- botocore(install version:1.13.23 version range:>=1.13.23,<1.14.0)
| | | | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| | | | +- s3transfer(install version:0.2.1 version range:>=0.2.0,<0.3.0)
| | | +- botocore(install version:1.13.23 version range:*)
| | | | +- docutils(install version:0.15.2 version range:>=0.10,<0.16)
| | | | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| | | +- cfnresponse(install version:1.0.2 version range:*)
| | | +- troposphere(install version:2.5.2 version range:*)
| | | | +- cfn-flip(install version:1.2.2 version range:>=1.0.2)
| | +- boto3(install version:1.10.23 version range:*)
| | | +- botocore(install version:1.13.23 version range:>=1.13.23,<1.14.0)
| | | | +- docutils(install version:0.15.2 version range:>=0.10,<0.16)
| | | | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| | | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| | | +- s3transfer(install version:0.2.1 version range:>=0.2.0,<0.3.0)
| | | | +- botocore(install version:1.13.23 version range:<2.0.0,>=1.12.36)
| | +- botocore(install version:1.13.23 version range:*)
| | | +- docutils(install version:0.15.2 version range:>=0.10,<0.16)
| | | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| | +- cfnresponse(install version:1.0.2 version range:*)
| | +- troposphere(install version:2.5.2 version range:*)
| | | +- cfn-flip(install version:1.2.2 version range:>=1.0.2)
| | | | +- click(install version:7.0 version range:*)
| | | | +- pyyaml(install version:5.2b1 version range:>=4.1)
| | | | +- six(install version:1.13.0 version range:*)
| +- aws-lambda(install version:1.0.0 version range:*)
| | +- boto3(install version:1.10.23 version range:*)
| | | +- botocore(install version:1.13.23 version range:>=1.13.23,<1.14.0)
| | | | +- docutils(install version:0.15.2 version range:>=0.10,<0.16)
| | | | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| | | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| | | +- s3transfer(install version:0.2.1 version range:>=0.2.0,<0.3.0)
| | | | +- botocore(install version:1.13.23 version range:<2.0.0,>=1.12.36)
| | +- botocore(install version:1.13.23 version range:*)
| | | +- docutils(install version:0.15.2 version range:>=0.10,<0.16)
| | | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| | +- cfnresponse(install version:1.0.2 version range:*)
| | +- troposphere(install version:2.5.2 version range:*)
| | | +- cfn-flip(install version:1.2.2 version range:>=1.0.2)
| | | | +- click(install version:7.0 version range:*)
| | | | +- pyyaml(install version:5.2b1 version range:>=4.1)
| | | | +- six(install version:1.13.0 version range:*)
| +- boto3(install version:1.10.23 version range:*)
| | +- botocore(install version:1.13.23 version range:>=1.13.23,<1.14.0)
| | | +- docutils(install version:0.15.2 version range:>=0.10,<0.16)
| | | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| | +- s3transfer(install version:0.2.1 version range:>=0.2.0,<0.3.0)
| | | +- botocore(install version:1.13.23 version range:<2.0.0,>=1.12.36)
| | | | +- docutils(install version:0.15.2 version range:>=0.10,<0.16)
| | | | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| +- botocore(install version:1.13.23 version range:*)
| | +- docutils(install version:0.15.2 version range:>=0.10,<0.16)
| | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| +- cfnresponse(install version:1.0.2 version range:*)
| +- troposphere(install version:2.5.2 version range:*)
| | +- cfn-flip(install version:1.2.2 version range:>=1.0.2)
| | | +- click(install version:7.0 version range:*)
| | | +- pyyaml(install version:5.2b1 version range:>=4.1)
| | | +- six(install version:1.13.0 version range:*) 

Thanks for your attention.
Best,
Neolith

[NeolithEra]

Suggested Solution

1. Fix your direct dependencies to be botocore <2.0.0.
2. Ask your upstream project boto3 to lose the version range of botocore to be >=1.13.23, and s3transfer to lose the version range of botocore to be >=1.12.36.

@laimonassutkus Which solution do you prefer, 1 or 2?
Please let me know your choice. May I pull a request to solve this issue?

[laimonassutkus]

Hello NeolithEra,

I feel extremely honored by you having time to review this project.

However, I want to tell you that at the same time, I am trying to get rid of this project completely by dividing it into smaller projects. AwsInfrastructureSdk has lost quite a lot of functionality which was migrated to my other projects:

AwsCodeStar
AwsDbMigration
AwsEcrMigration
AwsVpc
AwsCfCustomResources
AwsLambda

I strongly suggest you check out these mentioned projects as they are more robust, more complete with better documentation.

Please let me know what you think.