Upgrade to elasticsearch v8 or determine how to pin to v7 for dependabot

[jtherrmann]

Jira: https://asfdaac.atlassian.net/browse/TOOL-2899

Note: The above link is accessible only to members of ASF.

---

If we upgrade to elasticsearch v8.x.x, it needs to be coupled with an upgrade within AWS, which would require a CloudFormation change. However, it looks like updates are still being released for both v7 and v8 (see releases) so we could stay at v7 if we want, in which case we should see if we can configure dependabot to open version bumps only for v7.x.x releases, as it's currently trying to upgrade to v8: #75

[jtherrmann]

Dependabot should now ignore updates beyond v7. If we see any v8 bumps, or if we don't see anymore v7 bumps, then that would indicate that I got the dependabot config wrong.

[jtherrmann]

Let's keep this open until we confirm that dependabot is opening PRs for v7 minor and patch releases.

We're currently pinned to elasticsearch==7.10.1 and the latest v7 release on PyPI is 7.17.9 from Feb 2023, while the latest GitHub release is 7.17.23 from 3 weeks ago, so it looks like maybe the v7 updates are no longer being published to PyPI, so we might have to pin to GitHub.

I'm going to hold off on making further changes to dependabot until next Monday, just to see what happens. I would expect it to open a PR to upgrade to 7.17.9 from PyPI. In that case, we should:

• pin to the github repo in our requirements files
• confirm that dependabot opens a PR for the latest v7 release

I don't think dependabot.yml will need to change.

[jtherrmann]

We didn't see the expected dependabot PR to upgrade to the latest PyPI version, not sure why. May as well pin to a GitHub release and see if that works as expected.

[jtherrmann]

Oh, I was looking at the wrong GitHub repo. The actual release history is at https://github.com/elastic/elasticsearch-py/releases and shows that the latest v7 release is 7.17.9 from Feb 2023, same as PyPI (although there are a few more recent v7 tags, not sure why). So anyway, we can keep pinning to PyPI, but I'm still not sure why we didn't see a dependabot PR for upgrading v7.10.1 -> 7.17.9.

[jtherrmann]

I changed the ignore version from >7 to >=8. I think >7 matches any 7.x.x versions as well, so I was ignoring v7 upgrades as well. Hopefully now we're just ignoring anything v8 or greater, so we'll see a dependabot PR on Monday to upgrade to the latest v7 release.

[jtherrmann]

Nice, it worked: #98