Unpin requirements

[jcushman]

These should be set to minimum values instead of exact values in requirements.txt to avoid conflicts with other libraries:

courts-db==0.9.7
lxml==4.6.2
reporters-db==2.0.5
six==1.15.0

[jcushman]

Oh, also I assume six isn't required anymore.

[mlissner]

lxml would make me a bit nervous, but yeah, agree about the rest, though I'd wan to double check that we didn't use six anywhere.

[jcushman]

Oh, I wonder how requirements.txt relates to pyproject.toml's

[tool.poetry.dependencies]
python = "^3.7"
reporters-db = "^2.0.5"
courts-db = "^0.9.7"
lxml = "^4.6.2"

[tool.poetry.dev-dependencies]
...

I don't understand poetry (hah), but I'm guessing that list should be used to specify the dependencies for the pypi package, and requirements.txt should disappear?

lxml would make me a bit nervous

You should definitely pin it to a precise version in whatever projects you're including eyecite from. But eyecite itself shouldn't pin it beyond setting a minimum version -- if libraries all pinned lxml, you'd never be able to install two libraries that depended on lxml at the same time.

[mlissner]

OK, yep, that all sounds right. I thought we were in the CL repo at first.

Um, yes, we should decide on either requirements.txt (pypi) or Poetry. Doing both is definitely wrong. We've been trying poetry over in CL and it's been pretty nice. I'd say we should go for it here too. I think that just means tweaking our auto-deploy to use it and maybe tweaking our docs to explain how devs should use it?

[jcushman]

Sounds good to me! I haven't used poetry but have heard good things about it, so I'm happy with whatever you think makes sense.

[mlissner]

Do you think you'd want to tackle switching this over to Poetry? I just looked at the pypi.yml file for deployments and it's a bit tricky. I suspect it'd be better for @flooie to add this to his list (though it's pretty long right now).