python3-saml library has the following dependency mentioned in setup.py
install_requires=[
'isodate>=0.5.0',
'xmlsec>=0.6.0'
],
The xmlsec library itself has a lxml dependency pinned like this.
lxml >= 3.0
This is placing me in an unfortunate situation.
I want to pin down the version of lxml used by python3-saml project.
I can fork python3-saml, but what should I do so that my forked version python3-xml installs lxml==3.7.3
I think you are confusing the purpose of setup.py's install_requires. It is used by package maintainers to specify the compatible dependency versions, not to "pin" versions. See install_requires vs Requirements files.
Note that the dependencies you see in the two setup.py files here are not "pinned", as they allow multiple versions. See PEP 440 Version Specifiers.
Use pip to manage the installed versions of packages and transitive dependencies.
$ pip install python3-saml lxml==3.7.3
Now we can see that the desired version is installed.
$ pip freeze
defusedxml==0.5.0
isodate==0.6.0
lxml==3.7.3
pkgconfig==1.2.2
python3-saml==1.3.0
six==1.11.0
xmlsec==1.3.3
