Potential dependency conflicts between GyoiThon and urllib3

[NeolithEra]

Hi, ** GyoiThon** directly and transitively introduced multiple versions of urllib3.

As shown in the following full dependency graph of GyoiThon, GyoiThon requires urllib3 (the latest version), while the installed version of requests(2.22.0) requires urllib3>=1.21.1,<1.26.

According to Pip's “first found wins” installation strategy, urllib3 1.25.3 is the actually installed version.

Although the first found package version urllib3 1.25.3 just satisfies the later dependency constraint （urllib3>=1.21.1,<1.26), it will lead to a build failure once developers release a newer version of urllib3.

Dependency tree--------

GyoiThon(version range:)
| +-beautifulsoup4(version range:>=4.6.3)
| +-cchardet(version range:>=2.1.4)
| +-censys(version range:>=0.0.8)
| | +-requests(version range:)
| | | +-chardet(version range:>=3.0.2,<3.1.0)
| | | +-idna(version range:>=2.5,<2.9)
| | | +-urllib3(version range:>=1.21.1,<1.26)
| | | +-certifi(version range:>=2017.4.17)
| | +-netaddr(version range:)
| +-docopt(version range:>=0.6.2)
| +-google-api-python-client(version range:>=1.7.4)
| | +-httplib2(version range:>=0.9.2,<1dev)
| | +-google-auth(version range:>=1.4.1)
| | +-google-auth-httplib2(version range:>=0.0.3)
| | +-six(version range:>=1.6.1,<2dev)
| | +-uritemplate(version range:>=3.0.0,<4dev)
| +-jinja2(version range:>=2.10.1)
| +-matplotlib(version range:>=3.0.3)
| +-msgpack-python(version range:>=0.5.6)
| +-networkx(version range:>=2.2)
| +-pandas(version range:>=0.22.0)
| +-pysocks(version range:>=1.6.7)
| +-scrapy(version range:>=1.5.0)
| | +-Twisted(version range:>=13.1.0python)
| | +-Twisted(version range:>=13.1.0,<=19.2.0python)
| | +-w3lib(version range:>=1.17.0)
| | +-queuelib(version range:)
| | +-lxml(version range:)
| | +-pyOpenSSL(version range:)
| | +-cssselect(version range:>=0.9)
| | +-six(version range:>=1.5.2)
| | +-parsel(version range:>=1.5)
| | +-PyDispatcher(version range:>=2.0.5)
| | +-service_identity(version range:)
| +-tldextract(version range:>=2.2.1)
| | +-setuptools(version range:)
| | +-idna(version range:)
| | +-requests(version range:>=2.1.0)
| | | +-chardet(version range:>=3.0.2,<3.1.0)
| | | +-idna(version range:>=2.5,<2.9)
| | | +-urllib3(version range:>=1.21.1,<1.26)
| | | +-certifi(version range:>=2017.4.17)
| | +-requests-file(version range:>=1.4)
| +-urllib3(version range:>=1.25)

Thanks for your attention.
Best,
Neolith

[NeolithEra]

Solution

1. Fix your direct dependencies to be urllib3>=1.21.1,<1.26 and requests==2.22.0, to remove this conflict.

2. Remove your direct dependency urllib3, and use urllib3 transitively introduced by request.

I have checked the above two revisions will not affect your downstream projects now.
@ Please let me know your choice. I can submit a PR to solve this issue.

Build a good dependency ecosystem for python projects is our common goal ^_^.

@gyoisamurai May I pull a request to solve this issue?