Pip resolution-too-deep error related to the lack of semver requirements on dependencies jsonschema and requests

[thibaut-lo]

Hi 👋

I have been using oras-py as a dependency on a python project (with many other dependencies).

I have noticed a lot of backtracing from pip resolution algorithm, in particular because oras-py specifies no semver requirements on its dependencies, which is not usual as far as I know.

This may lead to a pip resolution-too-deep error, for which oras-py is a key contributor.

Would it be possible that you specify reasonable lower bounds for your Python dependencies?

Thanks a lot for your attention 🙏

[vsoch]

Sure, I'd be open to a PR that sets the lower bounds.