build: Set only lower bounds on core dependencies (#1382)

* Place only lower bounds (>=) on all core dependencies in setup.cfg
* Update lower bounds for core dependencies
   - Lower bounds established through empirical tests in CI with minimum supported dependencies workflow
* Effectively reverts PR #1378

.github/workflows/lower-bound-requirements.yml

@@ -22,11 +22,12 @@ jobs:
       uses: actions/setup-python@v2
       with:
         python-version: ${{ matrix.python-version }}
-    - name: Install dependencies
+    - name: Install dependencies and force lowest bound
       run: |
         python -m pip install --upgrade pip setuptools wheel
-        python -m pip install --no-cache-dir --requirement lower-bound-requirements.txt
+        python -m pip install --quiet --no-cache-dir --requirement lower-bound-requirements.txt
         python -m pip install --quiet --no-cache-dir --editable .[test]
+        python -m pip install --no-cache-dir --upgrade --requirement lower-bound-requirements.txt
         python -m pip list
     - name: Test with pytest
       run: |

lower-bound-requirements.txt

@@ -1,10 +1,10 @@
 # core
 scipy==1.4.1  # c.f. PR #1001
-click==7.0.0
+click==7.0
 tqdm==4.56.0
-jsonschema==3.2.0
-jsonpatch==1.23.0
-pyyaml==5.4
+jsonschema==3.0.0
+jsonpatch==1.15
+pyyaml==5.1
 # xmlio
 uproot3==3.14.1
 uproot==4.0.0

setup.cfg

@@ -36,12 +36,12 @@ packages = find:
 include_package_data = True
 python_requires = >=3.7
 install_requires =
-    scipy~=1.4  # requires numpy, which is required by pyhf and tensorflow
-    click~=7.0  # for console scripts
-    tqdm~=4.56  # for readxml
-    jsonschema~=3.2  # for utils
-    jsonpatch~=1.23
-    pyyaml>=5.4  # for parsing CLI equal-delimited options
+    scipy>=1.4.1  # requires numpy, which is required by pyhf and tensorflow
+    click>=7.0  # for console scripts
+    tqdm>=4.56.0  # for readxml
+    jsonschema>=3.0.0  # for utils
+    jsonpatch>=1.15
+    pyyaml>=5.1  # for parsing CLI equal-delimited options
 
 [options.packages.find]
 where = src