Require legacy-cgi on Python 3.13 or higher so WebOb works.

CHANGES.rst

@@ -6,6 +6,8 @@ repoze.who Changelog
 
 - Skip testing the crypt module if it does not exist, like on Python 3.13.
 
+- Require ``legacy-cgi`` on Python 3.13 or higher so ``WebOb`` works.
+
 - Add support for Python 3.12 and 3.13.
 
 3.0.0b1 (2023-01-16)

setup.py

@@ -26,8 +26,6 @@ def _read_file(filename):
 
 README = _read_file('README.rst')
 CHANGES = _read_file('CHANGES.rst')
-tests_require = ['WebOb', 'zope.interface']
-docs_extras = tests_require + ['Sphinx', 'repoze.sphinx.autointerface']
 
 setup(name='repoze.who',
       version='3.0.0b1',
@@ -61,8 +59,12 @@ def _read_file(filename):
       include_package_data=True,
       namespace_packages=['repoze', 'repoze.who', 'repoze.who.plugins'],
       zip_safe=False,
-      tests_require = tests_require,
-      install_requires=['WebOb', 'zope.interface', 'setuptools'],
+      install_requires=[
+        'WebOb',
+        'zope.interface',
+        'setuptools',
+        'legacy-cgi; python_version > "3.12"',  # WebOb uses the cgi module
+      ],
       test_suite="repoze.who",
       entry_points = """\
       [paste.filter_app_factory]
@@ -72,6 +74,6 @@ def _read_file(filename):
       authenticated = repoze.who.restrict:make_authenticated_restriction
       """,
       extras_require = {
-        'docs': docs_extras,
+        'docs': ['Sphinx', 'repoze.sphinx.autointerface'],
       },
 )

tox.ini

@@ -7,8 +7,6 @@ commands =
     python -m pytest --cov=repoze.who --cov-append --cov-report= {toxinidir}/repoze/who/tests/ {toxinidir}/repoze/who/plugins/tests/
 usedevelop=true
 deps =
-    zope.interface
-    WebOb
     virtualenv
     pytest
     pytest-cov