Limit dlms cosem sub dependency to MIT version

[elupus]

Proposed change

Make sure we don't accidentally upgrade a the dsrm_parser library containing a reference to a sub project with a incompatible license.

Type of change

• Dependency upgrade
• Bugfix (non-breaking change which fixes an issue)
• New integration (thank you!)
• New feature (which adds functionality to an existing integration)
• Deprecation (breaking change to happen in the future)
• Breaking change (fix/feature causing existing functionality to break)
• Code quality improvements to existing code or addition of tests

Additional information

• This PR fixes or closes issue: fixes DSMR Slimme Meter integration relies on non-Open Source Python module #122576
• This PR is related to issue:
• Link to documentation pull request:

Checklist

• The code change is tested and works locally.
• Local tests pass. Your PR cannot be merged unless tests pass
• There is no commented out code in this PR.
• I have followed the development checklist
• I have followed the perfect PR recommendations
• The code has been formatted using Ruff (ruff format homeassistant tests)
• Tests have been added to verify that the new code works.

If user exposed functionality or configuration variables are added/changed:

• Documentation added/updated for www.home-assistant.io

If the code communicates with devices, web services, or third-party tools:

• The manifest file has all fields filled out correctly.
  Updated and included derived files by running: python3 -m script.hassfest.
• New or updated dependencies have been added to requirements_all.txt.
  Updated by running python3 -m script.gen_requirements_all.
• For the updated dependencies - a link to the changelog, or at minimum a diff between library versions is added to the PR description.

To help with the load of incoming pull requests:

• I have reviewed two other open pull requests in this repository.

[joostlek]

Can you maybe trying to include cosem with the BSL version to see if the audit licenses script catches it?

[elupus]

Not sure how i would do that. It is a sub dependency of a package i dont control.

[joostlek]

Just replace the dsmr parser dependency with the cosem one. The code doesn't work, but then at least the dependency is checked in the CI

[joostlek]

Like if the audit fails, we dont have to include this constraint

[elupus]

That would not be a valid test since it would be a direct dependency instead of indirect.

[joostlek]

Pip licenses fetches all the packages installed on the system, so theoretically if you would bump the library to that version it should catch it. So what I'm trying to say, both direct and indirect dependencies are checked by the audit licenses check.

But since the license of cosem is proprietary/other(MIT), I'm curious what it will do and if this PR is needed

[frenck]

We already have license checks in place, we should not be able to upgrade to a release that violates.

So, I don't think we need to pin this on our end?

../Frenck

[elupus]

Looks like the license audit catches it. So closing.