setup.py has specific versions of dependancies

[brianmay]

setup.py has:

install_requires = [
    'asn1crypto==0.24.0',
    'cffi==1.12.2',
    'cryptography==2.6.1',
    'dj-database-url==0.4.1',
    'Django<=2.1.5',
    'django-argonauts==1.2.0',
    'django-debug-toolbar==1.11',
    'gunicorn==19.6.0',
    'psycopg2==2.7',
    'pycparser==2.19',
    'python-u2flib-server==5.0.0',
    'pytz==2018.9',
    'qrcode==6.1',
    'six==1.12.0',
    'sqlparse==0.3.0',
    'whitenoise==3.1',
]

This makes it impossible to use in any application, because it it is likely the application has different versions pinned.

Furthermore psycopg version 2.7 appears to be broken, need version 2.7.7.

There is no need to be so precise about versions in setup.py, do that in requirements.txt.

[brianmay]

To me it looks like a number of these dependencies aren't actually required for every single installation, and depend on the application and how it is deployed. e.g. gunicorn, psycopg2, pytz, six, whitenoise, django-debug-toolbar, etc.

[mwhawkins]

This package cannot be used until the requirements are fixed. It is outdated.

[zehawki]

In fact installing this ends up, without warning, quietly uninstalling my current Django version (2.2.14) and installing 2.1.5. It was quite puzzling, but after doing the pip install for this package, I suddenly began to see errors upon running runserver. After debugging, I realized that this installation was the culprit.

On a separate note: I dont even understand why pip would allow such a behavior. Ideally it should refuse to install the package with an error like "dependencies cant be met" or some such.

[ashwin31]

Fixed it