Pin stubs to their corresponding upstream version

Now that third party stubs are released as individual packages it would be great if the package included the upstream version range as an install requirements.

Currently the generated stubs contain a paragraph indicating the version they are intended for but, no such restriction is present in the setup.py file.

Issues #5768 and #5618 discuss allowing external dependencies, but they only allow to specify dependencies that are in fact dependencies of the corresponding upstream package, not the upstream package itself. In the example below it can be seen how types-requests depends on urllib3, but not on requests itself.

Adding the upstream package is important, as currently many teams use automated tools like Renovatebot or Dependabot to manage their dependencies, and without the explicit requirement you may end up with inconsistent deps. In our case someone in our team updated the types for protobuf to version 5.26, but we are restricted to use version 4.25. One could argue that any incompatibilities should be caught by CI, and it's true. But there's another case that is not prevented. First you upload the types of protobuf to the latest version, CI does not catch any errors, because you are using a small part of the library. Some time later you start working on a new feature and use a function or parameter that is only defined in the latest version. You write a test and it fails, and you end up scratching your head for a long time not understanding why that function/param is not present.

Examples

Requests

Cachetools

Start by tracing how third-party stubs are generated and how their setup.py metadata is produced. Compare the generated version paragraph with the package requirements shown for examples such as types-requests and types-cachetools. Done means released stub packages declare an appropriate requirement on the corresponding upstream package and preserve the intended upstream version range.