Remove safety/pyup

[zStupan]

There are currently 2 bots for updating dependencies set up for this repository: safety (pyup) and dependabot. Can someone please remove pyup?

Also I'm not sure the requirements.txt in the docs should be updated, at least not automatically, because those dependencies were pinned for a reason i. e. to ensure the docs build for readthedocs doesn't break.

[GregaVrbancic]

Hi, pyup webhook was deleted therefore it should no longer work.

Also I'm not sure the requirements.txt in the docs should be updated, at least not automatically, because those dependencies were pinned for a reason i. e. to ensure the docs build for readthedocs doesn't break.

Probably it is best to not automatically update the docs dependecies. Regarding the dependabot this was already done here or am I wrong?

I have also observed that some docs dependencies are also present in the pyproject.toml. Do we need them?

[GregaVrbancic]

Also, does anyone know why the dependabot updates only poetry.lock files like in PR #431 and #433? It should update pyproject.toml or am I wrong?

[zStupan]

I have also observed that some docs dependencies are also present in the pyproject.toml. Do we need them?

Yes, the requirements file in docs/ is used only when deploying to readthedocs. The docs dependencies in pyproject.toml are optional and are not installed by default, but can be installed for building the docs locally if need be.

Also, does anyone know why the dependabot updates only poetry.lock files like in PR #431 and #433? It should update pyproject.toml or am I wrong?

It's the default setting for libraries. Because when installing the library pip installs the latest compatible dependencies anyway, I think. This can be changed in the config file by setting versioning-strategy to "increase".

[GregaVrbancic]

Yes, the requirements file in docs/ is used only when deploying to readthedocs. The docs dependencies in pyproject.toml are optional and are not installed by default, but can be installed for building the docs locally if need be.

Great, this seems reasonable.

It's the default setting for libraries. Because when installing the library pip installs the latest compatible dependencies anyway, I think. This can be changed in the config file by setting versioning-strategy to "increase".

Oh, I see. However, lock file can cause quite some problems using different OS as well as with those optional dependencies. We should think through what is the most suitable strategy to use for dependabot.