Adjust pins for 'mindeps' build and expand comment
@@ -11,11 +11,19 @@ extras = tests
deps =
!marshmallowdev: marshmallow>=3.0.0,<4.0.0
marshmallowdev: https://github.com/marshmallow-code/marshmallow/archive/dev.tar.gz
-# for 'mindeps', list flask dependencies to ensure a successful install
-# because flask 1.x does not set upper bounds on the versions of its pallets dependencies
- mindeps: Flask==1.0.4
+
+# for 'mindeps', pin flask to 1.1.3 and markupsafe to 1.1.1
+# because flask 1.x does not set upper bounds on the versions of its dependencies
+# generally, we can't install just any version from 1.x -- only 1.1.3 and 1.1.4
+# markupsafe is a second-order dependency of flask (flask -> jinja2 -> markupsafe)
+# and must be pinned explicitly because jinja2 does not pin its dependencies in any
+# versions in its 2.x line
+# see:
+# https://github.com/marshmallow-code/webargs/pull/694
+# https://github.com/pallets/flask/pull/4047
+# https://github.com/pallets/flask/issues/4455
+ mindeps: flask==1.1.3
mindeps: markupsafe==1.1.1
- mindeps: itsdangerous==1.1.0
# all non-flask frameworks
mindeps: Django==2.2.0
mindeps: bottle==0.12.13
