title: How to pin transitive dependencies with setup.py in python?
body: <p><a href="https://github.com/onelogin/python3-saml/blob/master/setup.py" rel="nofollow noreferrer">python3-saml</a> library has the following dependency mentioned in setup.py</p>
  
  <pre><code>install_requires=[
      'isodate&gt;=0.5.0',
      'xmlsec&gt;=0.6.0'
  ],
  </code></pre>
  
  <p>The <a href="https://github.com/mehcode/python-xmlsec/blob/master/requirements.txt" rel="nofollow noreferrer">xmlsec</a> library itself has a lxml dependency pinned like this.</p>
  
  <pre><code>lxml &gt;= 3.0
  </code></pre>
  
  <p>This is placing me in an unfortunate situation.</p>
  
  <p>I want to pin down the version of lxml used by python3-saml project.
  I can fork python3-saml, but what should I do so that my forked version python3-xml installs <code>lxml==3.7.3</code></p>