requirements: pin urllib3 version to prevent request problems

[cmatsuoka]

• Have you signed the CLA?

---

[lengau]

Looks like this is related to requests_unixsocket and someone has opened a PR on it: msabramo/requests-unixsocket#69

Could you include that link in the comment so it's easy in future to see why we pinned urllib3 <2.?

[syu-w]

Maybe we can stop use that pyxdg package?

[lengau]

@syu-w probably... The project seems to be pretty inactive on freedesktop.org (https://gitlab.freedesktop.org/xdg/pyxdg), so I'm not sure whether it's considered actively maintained. The lack of response from maintainers on pull requests leads me towards thinking it's not, but I've bumped the xdg mailing list about it.

For what we use it for, implementing the standard directly ourselves probably wouldn't be that bad, but from a "health of the community" perspective I'd rather see the package updated.

[syu-w]

@syu-w probably... The project seems to be pretty inactive on freedesktop.org (https://gitlab.freedesktop.org/xdg/pyxdg), so I'm not sure whether it's considered actively maintained. The lack of response from maintainers on pull requests leads me towards thinking it's not, but I've bumped the xdg mailing list about it.

For what we use it for, implementing the standard directly ourselves probably wouldn't be that bad, but from a "health of the community" perspective I'd rather see the package updated.

I mean not because it is inactive, but the xdg compatibility issues. There are multiple xdg packages and the system one seems could broke the one install from pip.

[cmatsuoka]

Also including the xdg pyright workaround to avoid dependency deadlock.