Trac #33520: scipy, networkx: Update install-requires.txt

After #33336 and #33495, we should change the upper version bounds in
`build/pkgs/.../install-requires.txt`

URL: https://trac.sagemath.org/33520
Reported by: mkoeppe
Ticket author(s): Matthias Koeppe
Reviewer(s): Tobias Diez

build/pkgs/networkx/install-requires.txt

@@ -1,2 +1,2 @@
-# gentoo uses 2.5
-networkx >=2.4, <2.7
+# features removed in 3.0 listed in https://networkx.org/documentation/stable/developer/deprecations.html#version-3-0
+networkx >=2.4, <3.0

build/pkgs/scipy/install-requires.txt

@@ -1 +1,7 @@
-scipy >=1.5, <1.8
+# 1.8 is known good version.
+# Per https://docs.scipy.org/doc/scipy/dev/core-dev/index.html#version-numbering
+# and https://docs.scipy.org/doc/scipy/dev/core-dev/index.html#deprecations,
+# deprecations cannot be introduced in micro releases.
+# SciPy devs wait "at least 6 months", "in practice two (minor) releases"
+# from deprecation to removal of a feature.
+scipy >=1.5, <1.11

src/doc/en/developer/packaging.rst

@@ -586,8 +586,9 @@ and upper bounds).  The constraints are in the format of the
 or `setup.py
 <https://packaging.python.org/discussions/install-requires-vs-requirements/#id5>`_.
 
-The files may include comments (starting with ``#``) that explain why a particular lower
-bound is warranted or why we wish to include or reject certain versions.
+It is strongly recommended to include comments (starting with ``#``)
+in the file that explain why a particular lower or upper bound is
+warranted or why we wish to include or reject certain versions.
 
 For example:
 
@@ -612,6 +613,8 @@ Developers and downstream packagers are invited to refine the version
 constraints based on their experience and tests.  When a package
 update is made in order to pick up a critical bug fix from a newer
 version, then the lower bound should be adjusted.
+Setting upper bounds to guard against incompatible future changes is
+a complex topic; see :trac:`33520`.
 
 
 .. _section-spkg-SPKG-txt: