[requirements] relax pinning

[josh-hadley]

Strict pinning with == in AFDKO's requirements.txt can result in downgrades to packages that are shared by other co-installed projects. Use of >= enforces only the minimum version specified and allows later versions.

Closes #408 .

[anthrotype]

if you're not pinning exact versions anymore in requirements.txt, then there is no point in keeping that file. The setup.py's install_requires containing the same dependencies and minimum versions is sufficient.

I'm not sure if you're still using pyup bot or not, but I believe it will only update versions for requirements that have == version specifiers, and ignore those with >=.

Having a requirements.txt with fixed versions is still a good idea, because it ensures that your test runs are predictable and deterministic and do not depend on the time when you run them (e.g. it may be that some new version breaks something in your test suite, which would pass before and now no longer does, simply because a new version of a dep has been uploaded to PyPI).

The setup I settled on in my projects is this: setup.py install_requires are open-ended and are bumped up only when needed (e.g. you require some specific symbol that has been introduced in a newer version, or a bug was fixed, etc.); whereas the requirements.txt contains exactly pinned versions that are periodically kept up-to-date with latest versions (using pyup.io bot or similar).

If you really want to read the dependencies from the same source file for both requirements.txt and setup.py maybe you could resort to this hack. You keep requirements.txt as it is now, with exactly pinned versions. But then, when you read that file's content from the setup.py script, you replace all == with >= and then you'll have open-ended minimum version specifiers in install_requires and pinned exact versions in requirements.txt.
It's not that bad, actually.

[josh-hadley]

@anthrotype I implemented the scheme you described. Please review and if this is suitable, please approve and we'll proceed to get it merged & released.

[anthrotype]

LGTM, thanks