Improved pip backtracking optimization

Signed-off-by: Andreas Maier <andreas.r.maier@gmx.de>

dev-requirements.txt

@@ -12,25 +12,32 @@
 # Indirect dependencies that must be handled early:
 
 # importlib-metadata
-# flake8 4.0/5.0 requires importlib-metadata>=1.1.0,<4.3 on Python<=3.7.
-#   The pinning to <4.3 is because flake8 <6.0 has not yet adjusted to the
-#   removed interfaces of importlib-metadata 5.0.
-# tox 3.14 requires importlib-metadata<1,>=0.12 on Python<=3.7
-# tox 3.21 requires importlib-metadata>=0.12 on Python<=3.7
-importlib-metadata>=2.1.3,<5; python_version == '3.6'
-importlib-metadata>=4.8.3,<5; python_version == '3.7'
-importlib-metadata>=4.8.3; python_version >= '3.8'
+# importlib-metadata
+# importlib.metadata was integrated to standard Python in Python 3.8, so as a
+#   package it is only needed in Python<=3.7.
+# importlib-metadata 5.0 removed interfaces, and in the version integrated to
+#   Python, that was done in Python 3.12 which integrated importlib-metadata 6.5.
+# flake8 4.0/5.0 requires importlib-metadata>=1.1.0,<4.3 on Python<=3.7. flake8
+#   pins importlib-metadata (at least) because flake8 <6.0 has not yet adjusted
+#   to the removed interfaces in importlib-metadata 5.0 / Python 3.12.
+# virtualenv 20.16.3 started requiring importlib-metadata>=4.8.3
+# virtualenv 20.22.0 started requiring importlib-metadata>=6.4.1
+importlib-metadata>=2.1.3,<5; python_version <= '3.7'
 
 
 # Direct dependencies:
 
 # Coverage reporting (no imports, invoked via coveralls script):
-coverage>=5.0
+# coveralls 3.3.0 pins coverage to <7.0, causing pip backtracking to happen. Pinning
+#   it to <7.0 in this file saves the time for backtracking, but requires to
+#   occasionally check for new versions of coveralls without pinning.
+coverage>=5.0,<7.0
 pytest-cov>=2.7.0
 coveralls>=3.3.0
 
 # Safety CI by pyup.io
-safety>=2.2.0
+# safety 2.3.5 (only) requires packaging>=21.0,<22.0 and causes pip backtracking of tox
+safety>=2.2.0,!=2.3.5
 # safety 2.2.0 requires dparse>=0.6.2
 dparse>=0.6.2
 
@@ -46,29 +53,29 @@ Click>=8.0.2
 PyYAML>=5.3.1
 
 # Tox
-# tox 3.17 requires six>=1.14.0 - covered in requirements.txt
-# Pinning tox to <4.0.1 is a pip backtracking optimization:
-#   tox 4.0.1 requires packaging>=22, but we need packaging<22
-tox>=3.21.0,<4.0.1
+# tox 3.21 requires importlib-metadata>=0.12 on Python<=3.7
+tox>=3.21.0
 
 # Sphinx (no imports, invoked via sphinx-build script):
-# Keep in sync with rtd-requirements.txt
-
 # Sphinx 4.0.0 breaks autodocsumm and needs to be excluded
+# Sphinx 4.0.0,4.0.1 (only) pin Jinja2 to <3.0
 # Sphinx <4.2.0 fails on Python 3.10 because it tries to import non-existing
 #   types.Union. This also drives docutils>=0.14.
-# Sphinx pins docutils to <0.18 (some versions even to <0.17) but the package
-#   version resolver in the pip version used on py27 ignores package dependencies
-# Pinning Sphinx to <6.0.0 is a pip backtracking optimization:
-#   Sphinx 6.0.0 requires docutils>=0.18,<0.20, but we need docutils>=0.16,<0.17
-Sphinx>=4.2.0,<6.0.0
-docutils>=0.16,<0.17
+# Sphinx 4.4.0 started requiring importlib-metadata>=4.4
+# Sphinx 6.0.0 dropped support for Python <=3.7
+# Sphinx 7.2.0 dropped support for Python 3.8
+Sphinx>=4.2.0,<4.4.0; python_version <= '3.7'
+Sphinx>=4.2.0; python_version >= '3.8'
+docutils>=0.16
 sphinx-git>=10.1.1
+# GitPython 3.1.24 dropped support for Python 3.6
 GitPython>=2.1.1; python_version == '3.6'
 GitPython>=3.1.41; python_version >= '3.7'
 sphinxcontrib-fulltoc>=1.2.0
 sphinxcontrib-websupport>=1.1.2
-Pygments>=2.1.3
+Pygments>=2.7.4; python_version == '3.6'
+Pygments>=2.15.0; python_version >= '3.7'
+# sphinx-rtd-theme 2.0.0 requires Sphinx>=5,<8
 sphinx-rtd-theme>=1.0.0
 # Babel 2.7.0 fixes an ImportError for MutableMapping which starts failing on Python 3.10
 Babel>=2.9.1
@@ -80,10 +87,10 @@ Babel>=2.9.1
 # Pylint 2.14 / astroid 2.11 support wrapt 1.14 which is required for Python 3.11, but in addition:
 # Pylint 2.15 / astroid 2.12 is needed to circumvent issue https://github.com/PyCQA/pylint/issues/7972 on Python 3.11
 # Pylint 2.14 / astroid 2.11 dropped support for py36
-pylint>=2.13.0; python_version <= '3.6'
+pylint>=2.13.0; python_version == '3.6'
 pylint>=2.15.0; python_version >= '3.7' and python_version <= '3.11'
 pylint>=3.0.3; python_version >= '3.12'
-astroid>=2.11.0; python_version <= '3.6'
+astroid>=2.11.0; python_version == '3.6'
 astroid>=2.12.4; python_version >= '3.7' and python_version <= '3.11'
 astroid>=3.0.2; python_version >= '3.12'
 # astroid 2.13.0 uses typing-extensions on Python<3.11 but misses to require it on 3.10. See https://github.com/PyCQA/astroid/issues/1942
@@ -101,7 +108,7 @@ isort>=4.3.8
 tomlkit>=0.10.1
 # dill is used by pylint >=2.13
 # dill 0.3.5 dropped support for Python 3.6
-dill>=0.3.4; python_version <= '3.6'
+dill>=0.3.4; python_version == '3.6'
 dill>=0.3.6; python_version >= '3.7'
 # platformdirs is used by pylint starting with its 2.10
 platformdirs>=2.2.0; python_version <= '3.11'
@@ -112,25 +119,35 @@ platformdirs>=3.2.0; python_version >= '3.12'
 mypy>=0.971
 
 # Flake8 and dependents (no imports, invoked via flake8 script):
-# flake8 4.0.0 fixes an AttributeError on Python 3.10.
-flake8>=3.8.0; python_version <= '3.9'
+# flake8 6.0.0 dropped support for Python<=3.7
+# flake8 4.0.0 fixed an AttributeError on Python 3.10
+# flake8 4.0/5.0 requires importlib-metadata>=1.1.0,<4.3 on Python<=3.7. flake8
+#   pins importlib-metadata (at least) because flake8 <6.0 has not yet adjusted
+#   to the removed interfaces in importlib-metadata 5.0 / Python 3.12.
+# flake8 3.8 requires pyflakes>=2.2.0,<2.3.0 and pycodestyle>=2.6.0a1,<2.7.0 and mccabe>=0.6.0,<0.7.0
+# flake8 3.9 requires pyflakes>=2.3.0,<2.4.0 and pycodestyle>=2.7.0,<2.8.0 and mccabe>=0.6.0,<0.7.0
+# flake8 4.0 requires pyflakes>=2.4.0,<2.5.0 and pycodestyle>=2.8.0,<2.9.0 and mccabe>=0.6.0,<0.7.0
+# flake8 5.0 requires pyflakes>=2.5.0,<2.6.0 and pycodestyle>=2.9.0,<2.10.0 and mccabe>=0.7.0,<0.8.0
+flake8>=3.9.0,<4.0.0; python_version <= '3.7'
+flake8>=4.0.0,<5.0.0; python_version >= '3.8' and python_version <= '3.9'
 flake8>=5.0.0; python_version >= '3.10'
 mccabe>=0.6.0; python_version <= '3.9'
 mccabe>=0.7.0; python_version >= '3.10'
-pycodestyle>=2.6.0; python_version <= '3.9'
+pycodestyle>=2.7.0; python_version <= '3.7'
+pycodestyle>=2.8.0; python_version >= '3.8' and python_version <= '3.9'
 pycodestyle>=2.9.0; python_version >= '3.10'
-pyflakes>=2.2.0; python_version <= '3.9'
+pyflakes>=2.3.0; python_version <= '3.7'
+pyflakes>=2.4.0; python_version >= '3.8' and python_version <= '3.9'
 pyflakes>=2.5.0; python_version >= '3.10'
 entrypoints>=0.3.0
 
 
 # Twine (no imports, invoked via twine script):
-twine>=1.8.1
+twine>=3.0.0
 # readme-renderer 23.0 has made cmarkgfm part of extras (it fails on Cygwin)
 readme-renderer>=23.0
 
-# safety 2.3.5 started pinning packaging to <22.0 and requires >=21.0
-packaging>=21.0,<22.0
+# packaging>=21.0
 
 # Package dependency management tools
 pipdeptree>=2.2.0

minimum-constraints.txt

@@ -44,13 +44,12 @@ pytest==7.0.0
 # Install test direct dependencies:
 
 # virtualenv
-virtualenv==20.15.0; python_version <= '3.11'
+virtualenv==20.2.1; python_version <= '3.11'
 virtualenv==20.23.0; python_version >= '3.12'
 
 # Indirect dependencies for test (must be consistent with test-requirements.txt, if present)
 
-# packaging (used by pytest)
-# Packaging 21.0 is required by safety 2.2.0
+# packaging (used by pytest, safety)
 packaging==21.3
 
 # pluggy (used by pytest, tox)
@@ -66,9 +65,7 @@ six==1.16.0; python_version >= '3.10'
 # Indirect dependencies that must be handled early (must be consistent with dev-requirements.txt)
 
 # importlib-metadata
-importlib-metadata==2.1.3; python_version == '3.6'
-importlib-metadata==4.8.3; python_version == '3.7'
-importlib-metadata==4.8.3; python_version >= '3.8'
+importlib-metadata==2.1.3; python_version <= '3.7'
 
 
 # Direct dependencies for development (must be consistent with dev-requirements.txt)
@@ -115,10 +112,10 @@ sphinx-rtd-theme==1.0.0
 Babel==2.9.1
 
 # PyLint (no imports, invoked via pylint script) - does not support py3:
-pylint==2.13.0; python_version <= '3.6'
+pylint==2.13.0; python_version == '3.6'
 pylint==2.15.0; python_version >= '3.7' and python_version <= '3.11'
 pylint==3.0.3; python_version >= '3.12'
-astroid==2.11.0; python_version <= '3.6'
+astroid==2.11.0; python_version == '3.6'
 astroid==2.12.4; python_version >= '3.7' and python_version <= '3.11'
 astroid==3.0.2; python_version >= '3.12'
 typing-extensions==3.10; python_version <= '3.10'
@@ -127,7 +124,7 @@ lazy-object-proxy==1.4.3
 wrapt==1.14
 isort==4.3.8
 tomlkit==0.10.1
-dill==0.3.4; python_version <= '3.6'
+dill==0.3.4; python_version == '3.6'
 dill==0.3.6; python_version >= '3.7' and python_version <= '3.10'
 dill==0.3.7; python_version >= '3.11'
 
@@ -138,24 +135,18 @@ platformdirs==3.2.0; python_version >= '3.12'
 mypy==0.971
 
 # Flake8 and dependents (no imports, invoked via flake8 script):
-# Flake8 and dependents (no imports, invoked via flake8 script):
-flake8==3.8.0; python_version >= '3.6' and python_version <= '3.9'
+flake8==3.9.0; python_version <= '3.7'
+flake8==4.0.0; python_version >= '3.8' and python_version <= '3.9'
 flake8==5.0.0; python_version >= '3.10'
-# pylint 2.10.0 depends on mccabe<0.7 and >=0.6 (python 3.6 - 3.10)
-# pylint 2.15.0 depends on mccabe >=0.6,<0.8 (python 3.11)
-#               astroid>=2.12.4,<=2.14.0-dev0
-# pylint 3.0.1 depends on mccabe >=0.6,<0.8
-# flake8 3.8.0 depends on mccabe<0.7 and >=0.6
-# flake8 5.0.0 depends on mccabe >=0.7.0,<0.8.0
 mccabe==0.6.0; python_version <= '3.9'
 mccabe==0.7.0; python_version >= '3.10'
-pycodestyle==2.6.0; python_version <= '3.9'
+pycodestyle==2.7.0; python_version <= '3.7'
+pycodestyle==2.8.0; python_version >= '3.8' and python_version <= '3.9'
 pycodestyle==2.9.0; python_version >= '3.10'
-pyflakes==2.2.0; python_version <= '3.9'
+pyflakes==2.3.0; python_version <= '3.7'
+pyflakes==2.4.0; python_version >= '3.8' and python_version <= '3.9'
 pyflakes==2.5.0; python_version >= '3.10'
 entrypoints==0.3.0
-functools32==3.2.3.post2; python_version == '2.7'  # technically: python_version < '3.2'
-
 
 # Twine (no imports, invoked via twine script):
 twine==3.0.0

test-requirements.txt

@@ -16,15 +16,19 @@ pytest>=7.0.0
 # Install test direct dependencies:
 
 # virtualenv
-# tox 3.21.0 requires virtualenv!=20.0.[0-7],>=16.0.0 and requires py>=3.5
-virtualenv>=20.15.0; python_version <= '3.11'
-virtualenv>=20.23.0; python_version >= '3.12'
+# virtualenv 20.18.0 dropped support for Python 3.6
+# virtualenv 20.16.3 started requiring importlib-metadata>=4.8.3, but
+#   flake8 4.0/5.0 requires importlib-metadata>=1.1.0,<4.3 on Python<=3.7
+# virtualenv 20.2.1 started removing the prior pinning of importlib-metadata to <3
+# tox 3.21.0 requires virtualenv!=20.0.[0-7],>=16.0.0 and requires Python >=3.5
+virtualenv>=20.2.1,<20.16.3; python_version <= '3.7'
+virtualenv>=20.2.1; python_version >= '3.8'
 
 
 # Indirect dependencies with special constraints:
 
-# packaging (used by pytest)
-packaging>=17.0
+# packaging (used by pytest, safety)
+packaging>=21.3
 
 # pluggy (used by pytest, tox)
 # Pluggy 0.12.0 has a bug causing pytest plugins to fail loading on py38