Pin stubs to their corresponding upstream version

Now that third party stubs are released as individual packages it would be great if the package included the upstream version range as an install requirements.

Currently the generated stubs contain a paragraph indicating the version they are intended for but, no such restriction is present in the setup.py file.

Issues #5768 and #5618 discuss allowing external dependencies, but they only allow to specify dependencies that are in fact dependencies of the corresponding upstream package, not the upstream package itself. In the example below it can be seen how types-requests depends on urllib3, but not on requests itself.

Adding the upstream package is important, as currently many teams use automated tools like Renovatebot or Dependabot to manage their dependencies, and without the explicit requirement you may end up with inconsistent deps. In our case someone in our team updated the types for protobuf to version 5.26, but we are restricted to use version 4.25. One could argue that any incompatibilities should be caught by CI, and it's true. But there's another case that is not prevented. First you upload the types of protobuf to the latest version, CI does not catch any errors, because you are using a small part of the library. Some time later you start working on a new feature and use a function or parameter that is only defined in the latest version. You write a test and it fails, and you end up scratching your head for a long time not understanding why that function/param is not present.

Examples

Requests

Cachetools

Inizia tracciando come vengono generati gli stub di terze parti e come vengono prodotti i relativi metadati setup.py. Confronta il paragrafo sulla versione generata con i requisiti del pacchetto mostrati per esempi come types-requests e types-cachetools. Il lavoro è completato quando i pacchetti stub rilasciati dichiarano un requisito appropriato per il corrispondente pacchetto upstream e mantengono l'intervallo di versioni upstream previsto.