Look into using Renovate or Dependabot to automatically manage dependency upgrades

[dpranke]

It would be nice if I had a more regular practice for releasing packages with upgraded dependences.

I had been thinking about using GitHub's dependabot, but in the discussion in #96,
ulgens@ suggested using Renovate instead, and pointed me at a set of defaults in
https://github.com/ulgens/renovate-presets.

[henryiii]

I recommend Dependabot for actions and pre-commit, but I know some people have had issues with it and Python deps. I like that it's simple, though. https://learn.scientific-python.org/development/guides/gha-basic/#updating

[dpranke]

I've actually been using Dependabot for a while now. Unfortunately, it seems to be limited in that there's no way to express more complex dependencies, like the fact that I have to depend on outdated packages when installing for outdated versions of Python (e.g., < 3.9), and I don't want to get warnings for them.

Not sure if Renovate is any better here.

[henryiii]

Renovate is probably better here - it's ridiculously configurable. Though "warnings" make me think that's the security part of Dependabot, which is confusing not quite the same thing. FWIW, I've been dropping 3.8 across all my remaining packages, the next release of packaging, scikit-build-core, etc. will all drop 3.8. People running 3.8 really don't want to be disturbed at this point. ;)

[dpranke]

IIRC, now that I think about it, a bigger problem might've distinguish dev dependencies from prod dependencies in Dependabot. The prod json5 package has no dependencies at all, after all, so these are just about dev dependencies. While there's probably no need to actually do development on anything < 3.11 (or something), some of the dependencies are used to run tests and I still want to be able to do those on the older python versions.

Then again, you're probably right that people on older versions of Python won't care much about newer versions of this package, it's been free of significant bugs for a long time.

[henryiii]

FYI, I was looking around here because of scientific-python/cookie#823 (I was making sure there were no/minimal dependencies so I could be sure it could run in WebAssembly), which ironically might be useful to this issue too. :) (I have never used Renovate and it's configuration has always scared me a bit).