requirements: consider upper-pins on invenio-* packages or installing an Invenio wrapper

[GraemeWatt]

I recently upgraded the HEPData/hepdata application to the latest invenio-accounts==5.0.0, invenio-oauthclient==4.0.0, invenio-theme==3.0.0 and invenio-userprofiles==3.0.0 (see PR #780). It was necessary to add finalize_app_entry_points to factory.py in commit 9f3b022. When seeking help for this issue via the Invenio RDM Chatroom, some useful suggestions were made.

Comment from Alex Ioannidis:

In general, for non-InvenioRDM use-cases (i.e. just using standalone invenio-* packages), I would highly recommend placing upper-pins on major versions (or using ^x.y.z) of all packages. The reason behind that is that without having some "coordinator" package that combines a valid set of major versions across all modules, it's very likely that you'll end up with incompatible dependencies (and whatever resolution tree pip or other tools end up with, is not guaranteed to be also a valid application). Such packages would be e.g. invenio for Invenio v3 framework, invenio-app-rdm for InvenioRDM.

Comment from Mirek Simek:

You might want to have a look at dependencies in our "oarepo" package - it contains invenio rdm dependencies without invenio-app-rdm, invenio-rdm-records. Version 12.x is based on RDM12 beta, 11.x is based on RDM11. https://pypi.org/project/oarepo/

Installing the most recent standalone invenio-* packages works for now, but if it causes problems in future, we might want to consider either placing upper-pins on major versions or instead installing a wrapper like oarepo. The disadvantage of the latter approach is that it would install additional packages that are not required by HEPData.