[3.8] Use pip-tools to pin dependencies (#5389)

.github/workflows/ci.yml

@@ -111,10 +111,10 @@ jobs:
     - name: Cache PyPI
       uses: actions/cache@v2
       with:
-        key: pip-ci-${{ runner.os }}-${{ matrix.pyver }}-{{ matrix.no-extensions }}-${{ hashFiles('requirements/*.txt') }}
+        key: pip-ci-${{ runner.os }}-${{ matrix.pyver }}-${{ matrix.no-extensions }}-${{ hashFiles('requirements/*.txt') }}
         path: ${{ steps.pip-cache.outputs.dir }}
         restore-keys: |
-            pip-ci-${{ runner.os }}-${{ matrix.pyver }}-{{ matrix.no-extensions }}-
+            pip-ci-${{ runner.os }}-${{ matrix.pyver }}-${{ matrix.no-extensions }}-
     - name: Cythonize
       if: ${{ matrix.no-extensions == '' }}
       run: |

.pre-commit-config.yaml

@@ -30,6 +30,8 @@ repos:
     exclude: >-
       ^docs/[^/]*\.svg$
   - id: requirements-txt-fixer
+    exclude: >-
+      ^requirements/dev.txt$
   - id: trailing-whitespace
   - id: file-contents-sorter
     files: |

CHANGES/5389.misc

@@ -0,0 +1 @@
+Use pip-tools to pin dependencies

Makefile

@@ -135,10 +135,17 @@ doc:
 doc-spelling:
 	@make -C docs spelling SPHINXOPTS="-W -E"
 
-.PHONY: install
-install:
+.update-pip:
 	@pip install -U 'pip'
-	@pip install -Ur requirements/dev.txt
+
+.PHONY: compile-deps
+compile-deps: .update-pip
+	@pip install pip-tools
+	@pip-compile --allow-unsafe -q requirements/dev.in
+
+.PHONY: install
+install: .update-pip
+	@pip install -r requirements/dev.in -c requirements/dev.txt
 
 .PHONY: install-dev
 install-dev: .develop

requirements/dev.in

@@ -0,0 +1,4 @@
+-r lint.txt
+-r test.txt
+-r doc.txt
+cherry_picker==1.3.2; python_version>="3.6"

requirements/dev.txt

@@ -1,4 +1,255 @@
--r lint.txt
--r test.txt
--r doc.txt
-cherry_picker==1.3.2; python_version>="3.6"
+#
+# This file is autogenerated by pip-compile
+# To update, run:
+#
+#    pip-compile --allow-unsafe requirements/dev.in
+#
+aiodns==2.0.0 ; sys_platform == "linux" or sys_platform == "darwin" and python_version >= "3.7"
+    # via -r requirements/base.txt
+aiohttp-theme==0.1.6
+    # via -r requirements/doc.txt
+aiosignal==1.1.2
+    # via -r requirements/base.txt
+alabaster==0.7.12
+    # via sphinx
+appdirs==1.4.4
+    # via
+    #   black
+    #   virtualenv
+async-generator==1.10
+    # via -r requirements/base.txt
+async-timeout==4.0.0a3
+    # via -r requirements/base.txt
+attrs==20.3.0
+    # via
+    #   -r requirements/base.txt
+    #   flake8-pyi
+    #   pytest
+babel==2.9.0
+    # via sphinx
+black==20.8b1 ; implementation_name == "cpython"
+    # via -r requirements/lint.txt
+blockdiag==2.0.1
+    # via sphinxcontrib-blockdiag
+brotli==1.0.9
+    # via -r requirements/base.txt
+cchardet==2.1.7
+    # via -r requirements/base.txt
+certifi==2020.12.5
+    # via requests
+cffi==1.14.4
+    # via
+    #   cryptography
+    #   pycares
+cfgv==3.2.0
+    # via pre-commit
+chardet==4.0.0
+    # via
+    #   -r requirements/base.txt
+    #   requests
+cherry_picker==1.3.2 ; python_version >= "3.6"
+    # via -r requirements/dev.in
+click==7.1.2
+    # via
+    #   black
+    #   cherry-picker
+    #   towncrier
+coverage==5.3.1
+    # via
+    #   -r requirements/test.txt
+    #   pytest-cov
+cryptography==3.3.1 ; platform_machine != "i686" and python_version < "3.9"
+    # via
+    #   -r requirements/test.txt
+    #   pyjwt
+    #   trustme
+distlib==0.3.1
+    # via virtualenv
+docutils==0.16
+    # via sphinx
+filelock==3.0.12
+    # via virtualenv
+flake8-pyi==20.10.0
+    # via -r requirements/lint.txt
+flake8==3.8.4
+    # via
+    #   -r requirements/lint.txt
+    #   flake8-pyi
+freezegun==1.0.0
+    # via -r requirements/test.txt
+frozenlist==1.1.1
+    # via
+    #   -r requirements/base.txt
+    #   aiosignal
+funcparserlib==0.3.6
+    # via blockdiag
+gidgethub==5.0.0
+    # via cherry-picker
+gunicorn==20.0.4
+    # via -r requirements/base.txt
+identify==1.5.12
+    # via pre-commit
+idna==2.10
+    # via
+    #   requests
+    #   trustme
+    #   yarl
+imagesize==1.2.0
+    # via sphinx
+incremental==17.5.0
+    # via towncrier
+iniconfig==1.1.1
+    # via pytest
+isort==5.6.4
+    # via -r requirements/lint.txt
+jinja2==2.11.2
+    # via
+    #   sphinx
+    #   towncrier
+markupsafe==1.1.1
+    # via jinja2
+mccabe==0.6.1
+    # via flake8
+multidict==5.1.0
+    # via
+    #   -r requirements/multidict.txt
+    #   yarl
+mypy-extensions==0.4.3 ; implementation_name == "cpython"
+    # via
+    #   -r requirements/test.txt
+    #   black
+    #   mypy
+mypy==0.790 ; implementation_name == "cpython"
+    # via
+    #   -r requirements/lint.txt
+    #   -r requirements/test.txt
+nodeenv==1.5.0
+    # via pre-commit
+packaging==20.8
+    # via
+    #   pytest
+    #   sphinx
+pathspec==0.8.1
+    # via black
+pillow==8.1.0
+    # via blockdiag
+pluggy==0.13.1
+    # via pytest
+pre-commit==2.9.3
+    # via -r requirements/lint.txt
+py==1.10.0
+    # via pytest
+pycares==3.1.1
+    # via aiodns
+pycodestyle==2.6.0
+    # via flake8
+pycparser==2.20
+    # via cffi
+pyflakes==2.2.0
+    # via
+    #   flake8
+    #   flake8-pyi
+pygments==2.7.4
+    # via
+    #   -r requirements/doc.txt
+    #   sphinx
+pyjwt[crypto]==2.0.0
+    # via gidgethub
+pyparsing==2.4.7
+    # via packaging
+pytest-cov==2.10.1
+    # via -r requirements/test.txt
+pytest-mock==3.5.1
+    # via -r requirements/test.txt
+pytest==6.1.2
+    # via
+    #   -r requirements/lint.txt
+    #   -r requirements/test.txt
+    #   pytest-cov
+    #   pytest-mock
+python-dateutil==2.8.1
+    # via freezegun
+pytz==2020.5
+    # via babel
+pyyaml==5.3.1
+    # via pre-commit
+re-assert==1.1.0
+    # via -r requirements/test.txt
+regex==2020.11.13
+    # via
+    #   black
+    #   re-assert
+requests==2.25.1
+    # via
+    #   cherry-picker
+    #   sphinx
+setuptools-git==1.2
+    # via -r requirements/test.txt
+six==1.15.0
+    # via
+    #   cryptography
+    #   python-dateutil
+    #   virtualenv
+snowballstemmer==2.0.0
+    # via sphinx
+sphinx==3.4.3
+    # via
+    #   -r requirements/doc.txt
+    #   sphinxcontrib-asyncio
+    #   sphinxcontrib-blockdiag
+sphinxcontrib-applehelp==1.0.2
+    # via sphinx
+sphinxcontrib-asyncio==0.3.0
+    # via -r requirements/doc.txt
+sphinxcontrib-blockdiag==2.0.0
+    # via -r requirements/doc.txt
+sphinxcontrib-devhelp==1.0.2
+    # via sphinx
+sphinxcontrib-htmlhelp==1.0.3
+    # via sphinx
+sphinxcontrib-jsmath==1.0.1
+    # via sphinx
+sphinxcontrib-qthelp==1.0.3
+    # via sphinx
+sphinxcontrib-serializinghtml==1.1.4
+    # via sphinx
+toml==0.10.2
+    # via
+    #   black
+    #   cherry-picker
+    #   pre-commit
+    #   pytest
+    #   towncrier
+towncrier==19.2.0
+    # via -r requirements/doc.txt
+trustme==0.6.0 ; platform_machine != "i686"
+    # via -r requirements/test.txt
+typed-ast==1.4.2
+    # via
+    #   black
+    #   mypy
+typing-extensions==3.7.4.3
+    # via
+    #   -r requirements/base.txt
+    #   async-timeout
+    #   black
+    #   mypy
+uritemplate==3.0.1
+    # via gidgethub
+urllib3==1.26.2
+    # via requests
+uvloop==0.14.0 ; platform_system != "Windows" and implementation_name == "cpython" and python_version < "3.9"
+    # via -r requirements/base.txt
+virtualenv==20.3.1
+    # via pre-commit
+webcolors==1.11.1
+    # via blockdiag
+yarl==1.6.3
+    # via -r requirements/base.txt
+
+# The following packages are considered to be unsafe in a requirements file:
+setuptools==51.3.1
+    # via
+    #   blockdiag
+    #   gunicorn
+    #   sphinx

requirements/test.txt

@@ -1,7 +1,7 @@
 
 -r base.txt
 coverage==5.3.1
-cryptography==3.2.1; platform_machine!="i686" and python_version<"3.9" # no 32-bit wheels; no python 3.9 wheels yet
+cryptography==3.3.1; platform_machine!="i686" and python_version<"3.9" # no 32-bit wheels; no python 3.9 wheels yet
 freezegun==1.0.0
 mypy==0.790; implementation_name=="cpython"
 mypy-extensions==0.4.3; implementation_name=="cpython"