dependecy conflict between botframework 4.11.0 and azure-identity 1.5.0

[asdkant-ey]

Version

4.11 (also happening with 4.10)

Describe the bug

botframework-connector == 4.11.0 (current) requires msal == 1.2.0
azure-identity == 1.5.0 (current) requires msal >=1.6.0,<2.0.0

This created a dependency conflict where bot libraries can't coexist in the same program. This used to work a couple of months ago (I bumped into this issue after revisiting some code I had worked on before).

To Reproduce

This is my requirements.txt file, just add it and run pipenv install -r requirements.txt (versions pinned to :

botbuilder-core == 4.11
azure-keyvault-secrets
azure-identity == 1.5
botbuilder-ai == 4.11

Expected behavior

Packages should install without conflict

Screenshots

Extract from the error message pipenv install shows:

[pipenv.exceptions.ResolutionFailure]: Warning: Your dependencies could not be resolved. You likely have a mismatch in your sub-dependencies.
  First try clearing your dependency cache with $ pipenv lock --clear, then try the original command again.
 Alternatively, you can use $ pipenv install --skip-lock to bypass this mechanism, then run $ pipenv graph to inspect the situation.
  Hint: try $ pipenv lock --pre if it is a pre-release dependency.
ERROR: ERROR: Could not find a version that matches msal<2.0.0,==1.2.0,>=0.4.1,>=1.6.0
Tried: 0.1.0, 0.1.0, 0.2.0, 0.2.0, 0.3.0, 0.3.0, 0.3.1, 0.3.1, 0.4.0, 0.4.0, 0.4.1, 0.4.1, 0.5.0, 0.5.0, 0.5.1, 0.5.1, 0.6.0, 0.6.0, 0.6.1, 0.6.1, 0.7.0, 0.7.0, 0.8.0, 0.8.0, 0.8.0, 0.9.0, 0.9.0, 1.0.0, 1.0.0, 1.1.0, 1.1.0, 1.2.0, 1.2.0, 1.3.0, 1.3.0, 1.4.0, 1.4.0, 1.4.1, 1.4.1, 1.4.2, 1.4.2, 1.4.3, 1.4.3, 1.5.0, 1.5.0, 1.5.1, 1.5.1, 1.6.0, 1.6.0, 1.7.0, 1.7.0, 1.8.0, 1.8.0
There are incompatible versions in the resolved dependencies.

Relevant extract from the output of pipenv graph as per the suggestion above:

azure-identity==1.5.0
  - msal [required: >=1.6.0,<2.0.0, installed: 1.2.0]
  - msal-extensions [required: ~=0.3.0, installed: 0.3.0]
    - msal [required: >=0.4.1,<2.0.0, installed: 1.2.0]
azure-keyvault-secrets==4.2.0
botbuilder-ai==4.11.0
  - botbuilder-core [required: ==4.11.0, installed: 4.11.0]
    - botframework-connector [required: ==4.11.0, installed: 4.11.0]
      - msal [required: ==1.2.0, installed: 1.2.0]

Additional context

This issue was also reported in botbuilder-samples repo's issue 2978

[taicchoumsft]

@axelsrz , could you give us your opinion on this issue?

[axelsrz]

Thanks for putting this in our radar @asdkant-ey, we will work this milestone to update our supported msal version

[asdkant-ey]

@axelsrz In the meantime what can I do? Is there a combination of library versions in particular I can use that works without going too far back in time?

[axelsrz]

@asdkant-ey I just submitted a PR that fix this issue, one option is to build from that branch/main when it gets merged. Another option would be to downgrade azure-identity until the latest compatible.