cli-core: pinning msal to beta in 2.41.0 causes dependency conflict
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
Can we please have this change: https://github.com/Azure/azure-cli/commit/c6abf9e43d5474373a8875f0cfef81cc95240f1f#diff-37e5a736993fcaf4777f4364e5ac8788749b56f7b28e64bd7ee9f1d4b3e6eb22R54 in a hotfix release?
Pinning `msal[broker]==1.20.0b1` causes the follwing dependency conflict:
```
There are incompatible versions in the resolved dependencies:
msal<2.0.0,>=1.12.0 (from azure-identity==1.11.0->-r /run/user/1000/pipenv7fg1ziurrequirements/pipenv-8hona6xp-constraints.txt (line 23))
msal[broker]==1.20.0b1 (from azure-cli-core==2.41.0->-r /run/user/1000/pipenv7fg1ziurrequirements/pipenv-8hona6xp-constraints.txt (line 50))
```
Because pre-releases, alphas and betas are not allowed by default.
On a general note, please take more care in not pinning dependencies too tightly in `setup.py`. Dependency hell is not a pleasant place to be in. Users need a bit of leeway with your dependencies because Azure libraries are not used in a vacuum. The `requirement.txt` file or package installer lock files (pipenv, poetry, flit, ...) are the place to hard-pin dependencies in the pythonic packaging paradigm, not `setup.py`.
Contributor guide
Assessment
This issue has not been assessed yet.