Hi, As I've started packaging Wallaby for Debian, I noticed that os-brick has very inflated version dependencies: $ diff -u ../requirements.txt requirements.txt --- ../requirements.txt 2021-03-08 10:54:44.896134101 +0100 +++ requirements.txt 2021-03-08 10:54:48.848127942 +0100 @@ -2,17 +2,16 @@ # of appearance. Changing the order has an impact on the overall integration # process, which may cause wedges in the gate later. -pbr!=2.1.0,>=5.4.1 # Apache-2.0 -eventlet>=0.25.1 # MIT -oslo.concurrency>=3.26.0 # Apache-2.0 -oslo.context>=2.23.0 # Apache-2.0 -oslo.log>=3.44.0 # Apache-2.0 -oslo.i18n>=3.24.0 # Apache-2.0 -oslo.privsep>=1.32.0 # Apache-2.0 -oslo.serialization>=2.29.0 # Apache-2.0 -oslo.service!=1.28.1,>=1.24.0 # Apache-2.0 -oslo.utils>=3.34.0 # Apache-2.0 -requests>=2.14.2 # Apache-2.0 -six>=1.10.0 # MIT -tenacity>=6.0.0 # Apache-2.0 -os-win>=3.0.0 # Apache-2.0 +pbr>=5.5.1 # Apache-2.0 +eventlet>=0.30.1 # MIT +oslo.concurrency>=4.4.0 # Apache-2.0 +oslo.context>=3.1.1 # Apache-2.0 +oslo.log>=4.4.0 # Apache-2.0 +oslo.i18n>=5.0.1 # Apache-2.0 +oslo.privsep>=2.4.0 # Apache-2.0 +oslo.serialization>=4.1.0 # Apache-2.0 +oslo.service>=2.5.0 # Apache-2.0 +oslo.utils>=4.8.0 # Apache-2.0 +requests>=2.25.1 # Apache-2.0 +tenacity>=6.3.1 # Apache-2.0 +os-win>=5.4.0 # Apache-2.0 Some of the above is clearly abusing. For example, I don't think Cinder really needs version 5.5.1 of PBR, and 5.5.0 should really be enough. I've traced it back to: https://review.opendev.org/c/openstack/os-brick/+/778807 If this is a consequence of the project stopping to test lower bounds of requirements, then this has gone really insane, and the bad practice must stop immediately to restore sanity, and we must revert. We're back 5 years ago where each projects was uselessly requiring the latest version of everything for no reason... From a downstream package maintainer perspective, this is a disaster move. Haven't we learned from our mistakes? Cheers, Thomas Goirand (zigo)