feat: update cachecontrol to 0.13.0

[ralbertazzi]

Pull Request Check List

Closes: #7997

@Secrus didn't want to step on your toes, just provide help :)

[popadi]

Initially I hoped that a new cachecontrol release will silently fix the issue described here (without having to update to a newer version of poetry OR to pin urllib3). However, because the toml file has ^0.12.9 for all releases and because the new cachecontrol was release as 0.13.0, this won't happen.

Question for the maintainers: what will be the lucky poetry versions that will benefit from this?

[ralbertazzi]

without having to update to a newer version of poetry OR to pin urllib3

I don't think anyone will release a fix for older versions of Poetry due to the limited time that maintainers can invest. The issue has been closed since fixed in latest versions, please update to 1.5

[dimbleby]

recent versions of poetry all pin to urrlib3<2, therefore if correctly installed they are not exposed to that issue anyway.

however this reminds me that this MR should allow that constraint to be relaxed, urllib3 version 3 is now out.

[ralbertazzi]

Could you point me to the release? I can only see 2.0.2

[dimbleby]

yes sorry, I meant 2. but either way, this MR should allow that to be relaxed

[dimbleby]

poetry still has a direct dependency on urllib3 -

poetry/src/poetry/publishing/uploader.py

Line 20 in 50e61e6

from urllib3 import util

- so this should not be removed.

[ralbertazzi]

Seemed really minor for me to be kept but I understand the reasoning, better to be safe than sorry!

[ralbertazzi]

Would you prefer to relax the constraint or pin it to ^2.0.2 to enforce the usage of a more recent version? I'd prefer the second but I also understand the Poetry direct dependency on urllib3 works ok with <2 too..

[dimbleby]

so far as I can see that import is only used to set up a Retry, which is configured to retry only for GETs; and the uploader never does a GET, it only POSTs.

So if that's right then that little pile of code could be deleted anyway. But double-check, I only skimmed it..!

[ralbertazzi]

I think you are totally right. Wouldn't it be better to then fix it to "POST" if the original goal was to retry uploads?

[dimbleby]

meh, if the code has been there for this long without anyone feeling the need to have working retries - I'd just delete it.

[ralbertazzi]

I was just writing that 😄 Makes sense

[frostming]

However, because the toml file has ^0.12.9 for all releases and because the new cachecontrol was release as 0.13.0, this won't happen.

I've released v0.12.13 with the necessary fixes

[github-actions]

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.