Please restore compatibility with requests, as niquests is not suitable for packaging

[mgorny]

As of 2.0.0, caldav added a dependency on niquests. This is a fork of requests, which also forks a number of other high profile Python packages, including urllib3, h2, aioquic. If this isn't enough to raise some eyebrows, their urllib3.future deliberately overwrites urllib3. As such, it cannot be used alongside regular urllib3, making the package effectively non-installable.

[tobixen]

Uff, too bad those concerns weren't raised in #457. I'll get out a 2.0.1-release shortly.

[tobixen]

Perhaps it will be httpx in version 3.0 then

[tobixen]

2.0.1 has been released. #457 has been reopened. There is at least three caldav-issues that have been fixed just by replacing requests to niquests, so I'm not very happy about the current situation now.

[mgorny]

Yeah, I'm sorry — I didn't even realize "niquests" existed until today. And yes, httpx would be much better — it's a mature library with good support. Thanks a lot!

[tobixen]

It does seem like waiting for requests 3.0 is rather futile. For caldav 3.0 I'm planning to do some redesigning and introducing async that's the perfect timing for getting httpx in place, but that will in best case happen in the autumn. So I think I will do it like this as for now:

• Use niquests in the master branch and in future 2.x.1-versions
• Use requests in future 2.x.0-versions, so package maintainers may choose a revision with a sensible dependency set.
• When I start working on 3.0, I will consider httpx, unless there exists better solutions then.

Does that sound like an acceptable solution?

[mgorny]

Yeah, I think that's good enough for us. That said, I personally would avoid niquests completely — it's not been well-tested and given that it overwrites urllib3, it's a major security liability.

[tobixen]

It should be quite easy to support niquests if niquests is installed, otherwise requests - but how to mark up this dependency in pyproject.toml?

In the long run, such a solution would probably cost me less less efforts than to do double releases. Though, according to the road map I may be able to start working with 3.0 already this year.

[mgorny]

how to mark up this dependency in pyproject.toml?

I'm afraid it's not possible.

What could work for us is code having fallback to requests, and we'd just sed the dependency ourselves.

[tobixen]

I will mark this issue as closed, as I'm doing dual releases by now.

#457 can be used for discussing or leaving feedback on niquests vs httpx.

In pull request #565 it's suggested to replace niquests with httpx.