Pin dependencies

[tsundvoll]

No description provided.

[FuzzyReality]

The code itself looks good to me. I am wondering some about the purpose of snyk_check.yml (see the specific comment for details), and also how and whenrequiremnts.txt is to be updated (what will be the policy for updating it, should we do it as part of a workflow or perhaps pre-commit-hook?)

[tsundvoll]

The code itself looks good to me. I am wondering some about the purpose of snyk_check.yml (see the specific comment for details), and also how and whenrequiremnts.txt is to be updated (what will be the policy for updating it, should we do it as part of a workflow or perhaps pre-commit-hook?)

Summary from discussion:

• Pre-commit hook seems like a good idea.
• In the future we can think about having some automated workflow that looks for updates on a regular basis. Useful for periods with little to no development (commits). One reason for having something like this (and for updating dependency versions regularly) is to avoid being too far behind when we eventually make the upgrade the dependency version. Another is that it will be easier to see when a dependency broke something.

We can take in this PR, and I will add the pre-commit hook later, since this setup provides some value already.

[FuzzyReality]

Good job!