Potential dependency conflicts between awsmfa and botocore

[NeolithEra]

Hi, as shown in the following full dependency graph of awsmfa, awsmfa requires botocore >=1.4.0 ， while the installed version of boto3(1.10.45) requires botocore >=1.13.45,<1.14.0.

According to Pip's “first found wins” installation strategy, botocore 1.13.45 is the actually installed version.

Although the first found package version botocore 1.13.45 just satisfies the later dependency constraint （botocore >=1.13.45,<1.14.0), it will lead to a build failure once developers release a newer version of botocore.

Dependency tree--------

awsmfa - 0.2.9
| +- boto3(install version:1.10.45 version range:>=1.3.0)
| | +- botocore(install version:1.13.45 version range:>=1.13.45,<1.14.0)
| | | +- docutils(install version:0.15.2 version range:>=0.10,<0.16)
| | | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| | +- s3transfer(install version:0.2.1 version range:>=0.2.0,<0.3.0)
| | | +- botocore(install version:1.13.45 version range:<2.0.0,>=1.12.36)
| | | | +- docutils(install version:0.15.2 version range:>=0.10,<0.16)
| | | | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| +- botocore(install version:1.13.45 version range:>=1.4.0)
| | +- docutils(install version:0.15.2 version range:>=0.10,<0.16)
| | +- jmespath(install version:0.9.4 version range:<1.0.0,>=0.7.1)
| +- pytz(install version:2019.3 version range:>=2016.1)
| +- six(install version:1.13.0 version range:>=1.10.0) 

Thanks for your attention.
Best,
Neolith

[NeolithEra]

Suggested Solution

1. Fix your direct dependencies to be botocore <1.14.0.
2. Ask your upstream project boto3 to lose the version range of botocore to be >=1.13.45, and s3transfer to lose the version range of botocore to be >=1.12.36.

@dcoker Which solution do you prefer, 1 or 2?
Please let me know your choice. May I pull a request to solve this issue?