[CT-2382] [Feature] allow a broader list of mashumaro versions.

[benallard]

Is this your first time submitting a feature request?

• I have read the expectations for open source contributors
• I have searched the existing issues, and I could not find an existing issue for this feature
• I am requesting a straightforward extension of existing dbt functionality, rather than a Big Idea better suited to a discussion

Describe the feature

Allow more mashumaro versions.

Describe alternatives you've considered

patching the requirment (setup.py) locally.

Who will this benefit?

any packager.

Are you interested in contributing this feature?

Sure.

Anything else?

I'm in the process of packaging dbt for AUR (arch), so the requirment on mashumaro has to be the current one (system-wide install and no virtual env).

BTW, I have the same issue with pathspec, and hologram at least. (and the test is running fine).

[benallard]

The AUR package is now working (as far as I tried it).

Those are the version 'relaxing' I had to perform:

• pathspec: 0.12 is working, so >=0.9,<0.12 (already in master)
• mashumaro: 3.5 is working, so >=3.3.1
• hologram: 0.0.16 is working, so >=0.0.14,<=0.0.16 (already in master)
• betterproto: 2.0.0b5 (not released yet) is working, so >=1.2.5

[jtcohen6]

For the reason @gshank outlined in #7294 (comment), we're going to keep mashumaro (and a few other critical packages) hard-pinned for now. We are supportive of bumping them to the latest version in each minor release of dbt-core.

We're okay with the version ranges for pathspec and hologram. We've removed the dependency on betterproto in main, by switching to use Google's protobuf library.

Let's use these discussions as the place to discuss our approach to dependencies more broadly, and to audit specific packages:

• Revise our approach to pinning dependencies #6495
• `dbt-core` Python dependency audit #6915