requirements: When removing future requirement, leave it commented.

futures is no longer there to be removed.  Be clear about why we’re
removing future (it was never a “pip-tools bug”), and leave evidence
behind to help indicate how long that will be needed.

Signed-off-by: Anders Kaseorg <anders@zulipchat.com>

requirements/dev.txt

@@ -63,6 +63,7 @@ docker==4.0.2             # via moto
 docutils==0.14            # via botocore, recommonmark, sphinx
 ecdsa==0.13.2             # via python-jose, sshpubkeys
 fakeldap==0.6.1
+# future==0.17.1            # via commonmark, python-jose, python-twitter
 gitlint==0.12.0
 h2==2.6.2                 # via hyper
 hpack==3.0.0              # via h2

requirements/docs.txt

@@ -13,6 +13,7 @@ certifi==2019.6.16        # via requests
 chardet==3.0.4            # via requests
 commonmark==0.9.0
 docutils==0.14            # via recommonmark, sphinx
+# future==0.17.1            # via commonmark
 idna==2.8                 # via requests
 imagesize==1.1.0          # via sphinx
 jinja2==2.10.1            # via sphinx

requirements/prod.txt

@@ -44,6 +44,7 @@ django-statsd-mozilla==0.4.0
 django-two-factor-auth==1.9.1
 django-webpack-loader==0.6.0
 django==1.11.23
+# future==0.17.1            # via python-twitter
 h2==2.6.2                 # via hyper
 hpack==3.0.0              # via h2
 html2text==2018.1.9

tools/update-locked-requirements

@@ -21,9 +21,12 @@ compile_requirements () {
     sed -i 's/-e //' "$output"
 
     if [ "$python_version" != "py2" ]; then
-        # pip-tools bug; future, futures are obsolete in python3
+        # Remove an unnecessary future requirement declared by commonmark,
-        sed -i '/futures==/d' "$output"
+        # python-jose, and python-twitter.
-        sed -i '/future==/d' "$output"
+        # https://github.com/readthedocs/commonmark.py/pull/188
+        # https://github.com/mpdavis/python-jose/pull/134
+        # https://github.com/bear/python-twitter/pull/614
+        sed -i 's/^future==/# &/' "$output"
     fi
 
     (