`requirements.txt` confusion

[zacharyburnett]

I see that requirements.txt provides upper pins for functional dependencies, creating a stable environment; as it is, however, it appears that the dependencies installed with a pip install using pyproject.toml will always be equal or later versions than those made from requirements.txt, since [project.dependencies] does not have upper pins.

However, in tox.ini, the env created from pyproject.toml has the -stable label, and the one created from requirements.txt is labeled -latest. Shouldn't these two names be flipped?

Originally posted by @zacharyburnett in #68 (comment)

[mperrin]

I have to admit I have been slightly confused by this all for a while myself. I'm not even really sure that it's necessary to maintain requirements in two different places. It would be a nice simplification to get away from having these redundantly maintained in two places.

I completely agree with your interpretation: The "requirements.txt" file is not a strict list of what's actually required, nor is it used in the install process by pip install, and in its use to set up the environments for the Tox tests those versions are not necessarily "latest".

Another bit of the history here is that the upper version pins in requirements.txt were added in large part to allow a range across a minor version x.y, instead of specifying a specific x.y.z. This was in order to reduce the churn of automated pull requests from Dependabot for every minor 0.0.1 release of something upstream. See spacetelescope/webbpsf#909 .