Adding upperbound to dependencies

[pedro-psb]

Hello!
I'm using django-storages + azurite on CI and eventually the azurite release will be behind what the python sdk (azure-core and azure-blob-storage) expect, which will cause an error about trying to use an unsupported version. This error will eventually go away when azurite adds support to that new version, but in the meantime the CI is broken.

This comment provides some options to avoid the errorr. Users like myself can definitely do that individually, but it would be nice if django-storages could avoid the situation.

My proposal is to add upperbound to azure dependencies, a simple integration test with azurite and let dependabot (or some automated solution) handle the bumping. E,g: when a new azure-blob-storage version comes out dependabot opens a PR to bump it, and if azurite hasnt added support to it yet, the bump PR fails the CI. When it passes/merges, a new patch release can be made with the upperbound updated.

I realize this is a bit ambitious, as it requires a new infrastructure for the project and more releasing work, but in theory a good part of it can be automated after some initial work, and I believe it would benefit the broad django-storages userbase.

Btw, I'm willing to help with the initial work if that sounds a good idea.

[dimbleby]

This project has no dependency on azurite, keeping in sync with azurite releases is none of its business.

From another direction: those of us who are not using azurite do not want to be held back from taking azure-storage-blob updates only because some other people are using azurite.

[pedro-psb]

That's a fair point, I went a bit off with the azurite testing.

But what about taking the azurite part out?
The core request I really wanna make is that a project that depends on django-storages directly won't get bitten by an unexpected transitive dependency update. If the dependencies (e.g, azure-core and azure-blog-storage for the azure) have upperbounds defined and those are explicitly bumped and released, a project can evaluate bumping django-storages (and only then getting new transitive dependencies bumps) before integrating that into the project.

[dimbleby]

It's a topic on which much internet ink has been spilled, there are valid arguments in either direction.

If you want reproducibility eg in CI you probably are better off looking into tooling that provides a lock file, like uv or poetry.