Requests version restriction

[dsoprea]

Why is it necessary for Shippo to control what version of Requests that our applications are supposed to use? We've been using Shippo happily for months, but now we're running into conflicts with our versioning. What problem was this meant to fix?

[dsoprea]

..It broke because Requests released a new version (https://github.com/psf/requests/releases/tag/v2.28.0) and Shippo seems to follow a pattern of specifying a narrow-enough Requests version that every Requests release breaks it. Looking back at the last bump at the end of February (ea25a09), it seems like Shippo must've been broken for six weeks after the Requests release in January before they the project finally bumped the version.

It looks like Shippo has been doing it for at least a couple of years, and, since there's no documentation, it leads me to believe that this is present just for legacy reasons. Do we know if we still need this? If so, can we document why both in the setup.py and the README.md? If we don't, can we merge this PR? This is causing conflicts with other projects that also have obscure versioning strictnesses.

#84

[Falibur]

Also facing this same problem. We use the latest requests version, so it would be great if this restriction can be removed.

[sondlerd]

Yes please, AWS SAM uses requests 2.28.0 but shippo requires 2.27.1. I'd love to use shippo but version conflicts... please upgrade to requests 2.28.0 so I can integrate shippo!