Dependencies too strict

Description

We use aws-sam-cli to deploy our lambdas. However, the dependencies it requires are pinned quite tightly:

six~=1.11.0
chevron~=0.12
click~=7.0
enum34~=1.1.6; python_version<"3.4"
Flask~=1.0.2
boto3~=1.9, >=1.9.56
PyYAML~=5.1
cookiecutter~=1.6.0
aws-sam-translator==1.14.0
docker~=4.0
dateparser~=0.7
python-dateutil~=2.6
pathlib2~=2.3.2; python_version<"3.4"
requests==2.22.0
serverlessrepo==0.1.9
aws_lambda_builders==0.4.0

This makes it harder to work with other libraries. In my specific case, pylint-quotes, which requires six==1.12.

Anecdotally, it seems aws-sam-cli works fine with six==1.12. For this reason, and also to make co-existence with other libs easier, I’d like to encourage you to provide wider version ranges where/if possible.

I understand there might be reasons behind this that I don’t see, so perhaps at least explaining those would help me come to terms with this.

Some reasoning

I install aws-sam-cli side-by-side with other libs to have the deploy scripts which depend on aws-sam-cli in the same repository as the rest of my Python project, which requires the other libs. pipenv won’t let me easily work around this, e.g. by letting me create another virtual environment for just the deploy scripts without non-trivial changes to the directory structure (can elaborate if needed). I also still believe this is a different issue and the version constraints should be relaxed, if possible.

Steps to reproduce

pipenv --three
pipenv install --dev aws-sam-cli
pipenv install --dev pylint-quotes

with the last command failing due to a conflict.

Observed result

Cannot install both libs, as they require six~=1.11.0 and six==1.12. I assume similar results for other approaches.

Expected result

Wider version ranges that would allow me to install these libs side by side. See above.

Workaround

One can force their dependency management system to ignore the conflict. For pipenv, installing aws-sam-cli as a --dev dependency and pylint-quotes as a default/normal package. This gives priority to the default packages requirements and installs six==1.12.

Additional environment details (Ex: Windows, Mac, Amazon Linux etc)

1. OS: MacOS 10.14.6 Mojave
2. sam --version: SAM CLI, version 0.22.0

[awood45]

I’d just add that the recommended installation methods are covered in our developer guide and avoid pip/pipenv installation difficulties. Our behaviors are tested as calls through the CLI, not patching directly into our code as a dependency.

[jfuss]

@HonzaRepresent We do not view SAM CLI as a library and why we keep our dependencies more locked down. As @awood45 stated, this is to make the CLI reproducible. If we start relaxing all the dependencies, than you might be installing something was that untested and would break the CLI. We know many people use PIP but we really don’t recommend it unless you really need to, it a very fragile way to install and requires the correct python version and to use a venv on your part (to get the isolation we are after).

My recommendation is to create a Makefile that will install SAM CLI into an venv on the system, if PIP is really want you want to use. You can then use that locally and in your CI environment, assuming the correct python versions we support are installed.

Closing this but feel free to re-open, if there are further questions on the topic.