Unpin dependencies' versions

[NoureldinYosri]

Description of the issue
We have several dependencies pinned at specific old version because newer version break the CI. Ideally we should either not have a version requirement of have version requirement beyond a specific release (e.g. >= or >). specifying a version requirement with ==, ~=, <=, < shouldn't be used.

The list of requirements that should be unpinned is
in cirq-core/requirements.txt:

• matplotlib~=3.0
  (pavoljuhas) leave as is, this pins the major version and includes the latest matplotlib-3.9.0
• numpy~=1.16
  done in NEP-29 - enforce minimum Python version 3.10 #6591
• sortedcontainers~=2.0
  (pavoljuhas) leave as is, pins the major version and includes the latest sortedcontainers-2.4.0

in cirq-core/cirq/contrib/requirements.txt:

• pylatex~=1.3.0 --> pylatex~=1.4
  done in Support Python 3.12 #6516, includes the latest pylatex-1.4.2
• quimb~=1.6.0 --> quimb~=1.7
  done in Support Python 3.12 #6516, includes the latest quimb-1.8.1
• numba~=0.58.0
  deleted in Support Python 3.12 #6516, transitive dependency of quimb

in dev_tools/pr_monitor/requirements.txt:
(pavoljuhas) - only used in containerized tool, defer after 1.4

• requests==2.31.0
• google-cloud-secret-manager==1.0.0

in dev_tools/requirements/deps/protos.txt:

• grpcio-tools~=1.56.0 --> grpcio-tools~=1.59.0
  done in Support Python 3.12 #6516, first version compatible with Python 3.12
• mypy-protobuf==3.4
  (pavoljuhas) leave as is, works with the grpcio-tools

in dev_tools/requirements/deps/format.txt:

• black==23.3.0 --> black==14.3.0
  done in Bump black from 23.3.0 to 24.3.0 in /dev_tools/requirements/deps #6512

in dev_tools/requirements/deps/dev-tools.txt:

• qiskit-aer~=0.12.2 --> qiskit-aer~=0.12.0
  done in Support Python 3.12 #6516, 0.12.* is compatible with OpenQASM 2.0. 0.12.0 installs with Python 3.12
• rstcheck~=3.3.1 --> rstcheck
  done in Freshen-up cirq dependencies #6616

in dev_tools/requirements/deps/pylint.txt:

• pylint~=2.13.0

in dev_tools/requirements/deps/mypy.txt:
(pavoljuhas) - defered to #6617

• mypy==1.2.0
• types-backports==0.1.3
• types-protobuf~=3.20
• types-requests==2.28.1
• types-setuptools==62.6.1

in dev_tools/requirements/deps/notebook.txt:

• notebook>=6.4.1,<=6.4.7 --> notebook~=7.0
  done in Freshen-up cirq dependencies #6616, includes latest notebook-7.2.0
• ipykernel==5.3.4 --> ipykernel~=6.29
  done in Freshen-up cirq dependencies #6616, includes latest ipykernel-6.29.4
• papermill~=2.3.2 --> papermill~=2.6
  done in Freshen-up cirq dependencies #6616, includes latest papermill-2.6.0
• seaborn~=0.11.1 --> seaborn~=0.12
  done in CI - deflake Isolated pytest Ubuntu #6603, includes latest seaborn-0.13.2

in dev_tools/requirements/deps/pytest.txt:

• pytest-cov~=3.0 --> pytest-cov
  done in Release pins from all pytest-related packages #6602
• coverage<=6.2 --> coverage~=7.4
  done in Release pins from all pytest-related packages #6602, has restored annotate, includes the latest coverage-7.5.3
• pytest-xdist~=2.2.0 --> pytest-xdist
  done in Release pins from all pytest-related packages #6602
• filelock~=3.0.12 --> filelock~=3.1
  done in Support Python 3.12 #6516, includes the latest filelock-3.14.0
• freezegun~=0.3.15 --> freezegun
  done in Release pins from all pytest-related packages #6602

---

Optionally these verndor related requirements should be unpinned

in cirq-aqt/requirements.txt:

• requests~=2.18
  (pavoljuhas) leave as is, includes the latest requests-2.32.2

in cirq-pasqal/requirements.txt:

• requests~=2.18
  (pavoljuhas) leave as is, includes the latest requests-2.32.2

in cirq-ionq/requirements.txt:

• requests~=2.18
  (pavoljuhas) leave as is, includes the latest requests-2.32.2

in cirq-rigetti/requirements.txt:

• pyquil>=3.2.0,<4.0.0
  (pavoljuhas) - wip in update(cirq-rigetti): use pyquil v4 #6281
  after which merge the minimum attrs version in Add attrs lower bound in requirements.txt #6633

[pavoljuhas]

specifying a version requirement with ==, ~=, <=, < shouldn't be used.

I feel it depends case to case. Expressions like matplotlib~=3.0 freeze the major version numbers only so we have some assurance there would be no API-breaking changes; at the same time we should be getting minor upgrades and have a decent range of compatible versions. The last stable matplotlib is at 3.8.2 so that requirement allows for the newest version.

For the requirement specifications under dev_tools/requirements it may be good to pin to specific versions such as black==23.3.0. These packages are for development environment where it is good to have the same code formatter and linter versions as used in the CI. It should also avoid surprises that the CI checks would stop passing because of a newer formatter or linter release.

[mhucka]

I apologize if this is off the mark, but my $0.02 based just on general principles is that I agree with Pavol.

For non-dev requirements, not using a version requirement or setting only a minimum version (using >= or >) would seem risky for users. As you know, major version changes in packages like Matplotlib or Numpy could very well introduce breaking changes. A new cirq-core release could address the resulting incompatibilities, but users might choose not to update their version of cirq-core right away, or they may not be able to update right away because they have a dependency on a pinned version of cirq-core in other software of theirs. If the cirq-core requirements only set a minimum version, then if the users update their copies of Matplotlib or Numpy or whatever, they may experience errors. (On can image a worst-case scenario where there are no overt errors yet some cirq behaviors potentially change, or numerical results are off, etc., however likely that is.)

So, in the end, it seems like specifying the requirements as, e.g., sortedcontainers~=2.0, is preferable for the non-dev requirements.

[pavoljuhas]

Partially implemented in #6616 - sufficient for the 1.4 release.

Reopening to track the leftover dependencies.