Potential dependency conflicts between freqtrade and urllib3

[NeolithEra]

Hi, as shown in the following full dependency graph of freqtrade, freqtrade requires urllib3 (the latest version)， while the installed version of requests(2.22.0) requires urllib3>=1.21.1,<1.26.

According to Pip's “first found wins” installation strategy, urllib3 1.25.3 is the actually installed version.

Although the first found package version urllib3 1.25.3 just satisfies the later dependency constraint （urllib3>=1.21.1,<1.26), it will lead to a build failure once developers release a newer version of urllib3.

Dependency tree--------

freqtrade(version range:)
| +-ccxt(version range:)
| +-SQLAlchemy(version range:)
| +-python-telegram-bot(version range:)
| +-arrow(version range:)
| +-requests(version range:)
| | +-chardet(version range:>=3.0.2,<3.1.0)
| | +-idna(version range:>=2.5,<2.9)
| | +-urllib3(version range:>=1.21.1,<1.26)
| | +-certifi(version range:>=2017.4.17)
| +-urllib3(version range:)
| +-wrapt(version range:)
| +-pandas(version range:)
| +-scikit-learn(version range:)
| +-scipy(version range:)
| +-joblib(version range:)
| +-jsonschema(version range:)
| +-TA-Lib(version range:)
| | +-numpy(version range:)
| +-tabulate(version range:)
| +-cachetools(version range:)
| +-coinmarketcap(version range:)
| | +-requests(version range:>=2.18.4)
| | | +-chardet(version range:>=3.0.2,<3.1.0)
| | | +-idna(version range:>=2.5,<2.9)
| | | +-urllib3(version range:>=1.21.1,<1.26)
| | | +-certifi(version range:>=2017.4.17)
| | +-requests_cache(version range:>=0.4.13)
| +-scikit-optimize(version range:)
| +-python-rapidjson(version range:)
| +-py_find_1st(version range:)

Thanks for your attention.
Best,
Neolith

[NeolithEra]

Solution

1. Fix your direct dependencies to be urllib3>=1.21.1,<1.26 and requests==2.22.0, to remove this conflict.
   I have checked this revision will not affect your downstream projects now.

2. Remove your direct dependency urllib3, and use the library urllib3 transitively introduced by requests.

@#1xmatthias Please let me know your choice.
I can submit a PR to fix this issue.

[xmatthias]

I think we pinned urllib3 due to a problem with requests (and probably forgot to unpin)

I'll look into it - i suspect we can simply update urllib to the latest version, but i'll need to test a little

[hroff-1902]

I'm a kind of doubting...
Netflix/bless#98

[NeolithEra]

@hroff-1902 What are your doubts?

[hroff-1902]

That you are actually an AI... 😁

[NeolithEra]

@hroff-1902 Sorry, I am not an AI, but I can become an AI in the future. ^_^

[xmatthias]

Thanks for the headsup, since requests has been upgrade we can safely update urllib3 now 👍