CI, update Sphinx versions to test

[jakobandersen]

• Update due to Sphinx 5 release.
• Also, update Black to avoid a bug in that package.
• And stop testing against Sphinx 3 versions due to incompatibility with newer Jinja 2 versions.
• Require Sphinx >= 4, and allow 5

[jakobandersen]

It looks like the Sphinx 3 versions do not work with the newest Jinja 2 versions, and our CI is failing due to that (sphinx-doc/sphinx#10291).
I suggest we stop testing against Sphinx < 4.

[michaeljones]

The README suggests Sphinx 3.0+ for requirements. Should we update that too? Are we dropping support for Sphinx < 4.0?

[jakobandersen]

The README suggests Sphinx 3.0+ for requirements. Should we update that too? Are we dropping support for Sphinx < 4.0?

Good point. Technically this issue is independent of Breathe, and the linked issue seems to suggest that one could pin Jinja to a lower version and then things work.
But Sphinx only supports its newest version anyway, so I see us testing against older versions as a "best effort" thing. Now it seems we can't easily test against Sphinx 3, so I suggest bumping to >=4.

[michaeljones]

So... we should update the README or not? Sorry :)

[jakobandersen]

So... we should update the README or not? Sorry :)

Yes :-), I have pushed an update to README and the requirements file. As Sphinx 5 is coming soon I bumped to allow it as well.

[michaeljones]

Nice!

[michaeljones]

Merge when you're happy :)

[jmckenna]

Polite nudge: Sphinx 5.0.0 was released yesterday, so that means without this PR merged nobody will be able to run Sphinx (that requires Breathe, but Breathe requires Sphinx < 5)

[jakobandersen]

@michaeljones, @vermeeren, a release should probably be made soon'ish due to the relaxed Sphinx dependency. While version 5.0.0 has problems there will be a version 5.0.1 quite soon I expect.

[AA-Turner]

v5.0.1 has been released: https://pypi.org/project/Sphinx/5.0.1

A

[vermeeren]

@jakobandersen Thanks for the work and keeping me up-to-date always. Is current master good for a release? Or some points that I should look at first?

(I will check all breathe mails old-to-new now.)

[jmckenna]

Polite nudge for a new Breathe release that contains this change (as so many other projects are being held back from upgrading Sphinx, due to Breathe "incompatibility" messages.

[michaeljones]

@vermeeren - do you have time to do a release? Can I still do a release? I suspect not so much as it is signed with your keys these days?

[vermeeren]

@michaeljones @jmckenna I will prepare to make a release now, shouldn't take too long.

[vermeeren]

The job is done.
Thanks again for all the contributions!

[vermeeren]

Oh and @michaeljones to answer your question properly. Indeed you can technically speaking still make a release, but it won't be PGP signed. This means distros (or users) checking PGP signatures properly will notice something is off so they'll check is anything went wrong or if something malicious happened (probably through issues and diffing sources).

So sort of yes but it's not practical as it breaks the security chain.