evaluate the tomli pin

[RonnyPfannschmidt]

Originally posted by @jhgit in #1090

we pin tomli to be lower than a specific version, the reason is unclear except for errors from years back

[jhgit]

I've successfully been using locally patched setuptools-scm with no pinning of tomli to <=2.0.2 (I am using with python 3.9 (now eol upstream, but still used / maintained with security patches in lots of environments, redhat 9 among them) and python 3.10 (still 8 months of breath left in its upstream life).

Has there been anything learned about the history of this pinning? The OP in #1090 (Nov 2024) was using python3.8. Maybe that was important for reproduction of the errors posted. I did not go back that far.

[RonnyPfannschmidt]

History (AI-assisted summary): The pin was added in #1090 because old pip used the toml library to read pyproject.toml; when pip fetched tomli as a build dep, it tried to parse tomli’s own pyproject.toml with that old toml and crashed. Pip 21.2 (July 2021) switched to vendoring tomli for TOML parsing, so pip ≥ 21.2 no longer hits this. The only environment that could still trigger it is pip < 21.2.

Conclusion: Five years is enough for that workaround to no longer be needed as protection; we can drop the pin.

[jhgit]

Thanks.
It seems like a problem with pip should not have resulted in the restriction that was added here. setuptools_scm didn't need the restriction, so adding it to the setuptools_scm pyproject.toml was probably ill-advised. I understand it's not a simple as that (but in some ways it really is).

[RonnyPfannschmidt]

Back then it was needed to prevent something else breaking builds

Aka Setuptools_scm did nothing wrong but another package creaed the pinch