Dependency management

[rozsasarpi]

I just came across this tool that seems to manage dependencies as well: https://pyup.io/.

It looks like a better solution than #39, although it would be yet another external tool.

[joergfunger]

Isn't that something that "just" checks for security changes, not necessarily updates that are not due to a security problem?

[rozsasarpi]

I interpreted this:

in a way that it would check if there are more up to date dependencies (not only for security reasons) and even open a PR to upgrade to them. The PR would automatically trigger our pipeline.

I will try to find a clearer description what it can do.

[rozsasarpi]

This seems to confirm my interpretation.

Also there is this alternative to pyup: https://github.com/dependabot/dependabot-core.

[joergfunger]

Looks good