install_requires should fix dependencies to specific versions

[svisser]

The install_requires value in setup.py does not specify the exact versions (dependency==0.1.0) and / or version bounds (dependency<=0.2) for all dependencies. This means that someone could install this project a year from now and it may not work because a dependency could have introduced a backwards incompatible change. It's therefore better to specify the versions and upgrade them yourself when you've verified that a newer version of a dependency works fine with this project.

[bormesh]

What do you think of putting the dependencies in requirements.txt ? That's where they are on this project, but interested in hearing pros cons to both approaches (as we've switched between the two methods of dependency tracking over different projects).

[svisser]

I don't have a straightforward answer but one approach is to put -e . in your requirements.txt and put the dependencies in install_requires: https://caremad.io/blog/setup-vs-requirement/. This prevents duplication and things still work.