What are the minimum supported versions of boto3 and requests?

[Quentin Pradet]

When trying to add support for urllib3 2.0, @hartwork ran into various issues, one of them being that "there is monkey patching of all sorts of bundled urllib3 copies happenning". Indeed, if we look at how urllib3 is imported, we can see three different things:

from urllib3.connectionpool import HTTPConnection, VerifiedHTTPSConnection
from requests.packages.urllib3.connectionpool import HTTPConnection, VerifiedHTTPSConnection
from botocore.vendored.requests.packages.urllib3.connectionpool import HTTPConnection, VerifiedHTTPSConnection (only in tests)

Do we still need this? requests 2.16.0 unvendored urllib3 back in 2017 and botocore 1.11.0 unvendored requests in 2018.

If you look at requests usage today, you can see that:

• requests 2.16+ represents 93% of downloads: https://pepy.tech/project/requests?versions=2.16.*&versions=2.17.*&versions=2.18.*&versions=2.19.*&versions=2.20.*&versions=2.21.*&versions=2.22.*&versions=2.23.*&versions=2.24.*&versions=2.25.*&versions=2.26.*&versions=2.27.*&versions=2.28.*&versions=2.29.*&versions=2.30.*
• botocore 1.11+ represents 94% of downloads: https://pepy.tech/project/botocore?versions=1.11.*&versions=1.12.*&versions=1.13.*&versions=1.14.*&versions=1.15.*&versions=1.16.*&versions=1.17.*&versions=1.18.*&versions=1.19.*&versions=1.2*

[Sebastian Pipping]

I found psf/requests@28666e5 that is included in requests >=2.16.2 as the arguably latest point where urllib3 was unvendored from requests.