idna 2.8 released

[Nothing4You]

idna 2.8 was just released. requests is pinned to idna>=2.5,<2.8

Can the pin be updated to allow v2.8?

[Vlad-Shcherbina]

By the way, out of curiosity, what's the reason to pin minor version number at all?
It seems it was first introduced in 1ea27b3, but there is no explanation in the commit metadata.

[sigmavirus24]

@Vlad-Shcherbina why have a lowest version we support? Because that's the lowest version we know works with idna at all. Libraries change things in subtly backwards incompatible ways. If we don't put together a range of known good versions, users will use whatever they want, shoot themselves in the foot, and demand we fix it for them. With only 2 people working on this project, no one has time for that

[asvetlov]

My 2 cents.

aiohttp library depends on yarl. In turn, yarl depends on idna>=2.0.
So far so good.
aiohttp uses twine check for making sure that setup.py is (at least partially) correct.
There is no surprise that twine uses the awesome requests (almost every tool that needs synchronous HTTP access uses requests).

Today our daily CI job has failed wit version conflict error. Sure, we can create a separate virtual env for twine usage or we can find another solution but the situation looks odd.

On another hand I understand the striving to pin everything for such community important project: any backward incompatibility in requests dependencies can hurt too many people.

[asvetlov]

Could you please make a new release?
Releasing requests==2.20.2 should not take too long perhaps.

[sigmavirus24]

Releasing requests==2.20.2 should not take too long perhaps.

Changing version constraints would lead to a 2.21 version. There's already a PR for upgrading the dependency version #4889