Add backoff to forbidden packages

[cdce8p]

Proposed change

backoff has been archived since last year. Unfortunately it still uses asyncio.iscoroutinefunction which has been deprecated since 3.14 and will be removed next year with 3.16. There was a PR to fix it but that one never got merged: litl/backoff#220

Looking at the fork network, it seems python-backoff might be the best replacement / successor. Last month it had over 5M downloads

https://pypi.org/project/python-backoff/
https://github.com/python-backoff/backoff
litl/backoff@v2.2.1...python-backoff:backoff:v2.3.1

There are 25 packages which depend on backoff currently. This PR adds backoff to the list of forbidden packages to hopefully prevent any new packages being added to depend on it.

Type of change

• Dependency upgrade
• Bugfix (non-breaking change which fixes an issue)
• New integration (thank you!)
• New feature (which adds functionality to an existing integration)
• Deprecation (breaking change to happen in the future)
• Breaking change (fix/feature causing existing functionality to break)
• Code quality improvements to existing code or addition of tests

Additional information

• This PR fixes or closes issue: fixes #
• This PR is related to issue:
• Link to documentation pull request:
• Link to developer documentation pull request:
• Link to frontend pull request:

Checklist

• I understand the code I am submitting and can explain how it works.
• The code change is tested and works locally.
• Local tests pass. Your PR cannot be merged unless tests pass
• There is no commented out code in this PR.
• I have followed the development checklist
• I have followed the perfect PR recommendations
• The code has been formatted using Ruff (ruff format homeassistant tests)
• Tests have been added to verify that the new code works.
• Any generated code has been carefully reviewed for correctness and compliance with project standards.

If user exposed functionality or configuration variables are added/changed:

• Documentation added/updated for www.home-assistant.io

If the code communicates with devices, web services, or third-party tools:

• The manifest file has all fields filled out correctly.
  Updated and included derived files by running: python3 -m script.hassfest.
• New or updated dependencies have been added to requirements_all.txt.
  Updated by running python3 -m script.gen_requirements_all.
• For the updated dependencies a diff between library versions and ideally a link to the changelog/release notes is added to the PR description.

To help with the load of incoming pull requests:

• I have reviewed two other open pull requests in this repository.

[Copilot]

Pull request overview

This pull request extends hassfest’s runtime dependency validation to forbid introducing new dependencies on the archived backoff package (due to upcoming incompatibility with Python 3.16), while adding per-integration exceptions for existing transitive uses.

Changes:

• Added backoff to FORBIDDEN_PACKAGES with guidance to use python-backoff instead.
• Added FORBIDDEN_PACKAGE_EXCEPTIONS entries for integrations whose dependency trees currently pull in backoff, preventing hassfest from failing on existing dependencies.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[mik-laj]

I have confirmed that migrating from backoff to python-backoff is problem-free. No code changes are needed.
frenck/python-wled#2060 (review)
Code with bakcoff usage:
https://github.com/frenck/python-wled/blob/a13af7878ffd58e9185068991329e97fea900dc5/src/wled/wled.py#L165-L171
Related test:
https://github.com/frenck/python-wled/blob/a13af7878ffd58e9185068991329e97fea900dc5/tests/test_wled.py#L101-L115

[cdce8p]

Since both packages share the same name, they will inevitably overwrite one another during install. Depending on the dependency resolution, the final package might at one point be backoff and at another python-backoff.

Added the constraints here to make sure that we don't accidentally depend on "new" features in python-backoff which aren't in backoff.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

[cdce8p]

There will be a transition period where we can't avoid having both in the dependency tree. With the dep resolution, it will depend which package gets installed last. That's exactly why compatible versions need to be pinned here / in package_constraints.txt.

[MartinHjelmare]

Thanks!