Python2.7 dependency issue

[bblommers]

cfn-lint version: 0.29.4

Hi,

When installing a project that has cfn-lint as a dependency (moto) using Python2.7, I'm getting this error:

Searching for networkx~=2.1
Reading https://pypi.org/simple/networkx/
...
Best match: networkx 2.4
...
NetworkX 2.3+ requires Python 3.5 or later (2.7 detected).
             
For Python 2.7, please install version 2.2 using:

$ pip install 'networkx==2.2'

It looks like this is due to incorrect usage of the ~= operator in setup.py:

'networkx~=2.4;python_version>="3.5"',
'networkx~=2.1;python_version<"3.5"'

This semantic has the same outcome for both python versions - use any version that's 2.x, but lower than 3.x.
IMO, this should say:

'networkx~=2.4;python_version>="3.5"',
'networkx<=2.2;python_version<"3.5"'

NetworkX 2.2 is the latest version that supports Python2: https://networkx.github.io/documentation/networkx-2.2/news.html

Happy to create a PR for this, if it's an acceptable change?

[bblommers]

Some more information:
The issue can be reproduced by running the following command:

python setup.py sdist

The issue goes away when I pin cfn-lint to an older version, i.e. "cfn-lint>=0.4.0,<=0.28.3", (which was the last release before the networkx dependency was introduced)

[PatMyron]

Is there a way networkx itself can prevent networkx 2.3+ installations through Python 2? That could also theoretically solve this for all networkx dependents

I wonder how our Python 2.7 tests end up with networkx 2.2

[kddejong]

@bblommers I think that works for me if you want to submit it.