chore(deps): Bump all dependencies

[LordAro]

Trying it myself, as dependabot apparently doesn't like when there are new dependencies-of-dependencies added? There's probably a better way of dealing with this with dependabot, but IDK what it is

Closes #251

[TrueBrain]

Not that what you did is wrong, but what I often do is just take over an existing dependabot PR. It makes it a bit easier, as you only have to fix what is wrong, instead of recreating it. It also means it has the history of what versions got bumped etc.

What is important to check versions that had major-version updates, to see what they were about. For example aiohttp 3.11 drops Python 3.8 support. Some parts of our software stack might still use 3.7, although most got bumped to 3.10. But more importantly, sometimes software like aiohttp changes parameters or something, making the software not work. But this isn't really noticeable in cases where we don't have a preview (like with dibridge), so we can't deploy it on staging. For most other projects that do have a staging, adding the "preview" label to the PR is enough to start that deployment. That way you can test if it actually works or not. Which is the ultimate validation of a PR :)

The only thing in the list of bumps that really stands out, is six. six is a library to make Py2 -> Py3 easier, and I do not really understand why that is re-introduced. As in, who in their right mind added a dependency that still needs six? That is something worth checking out.

[TrueBrain]

The only thing in the list of bumps that really stands out, is six. six is a library to make Py2 -> Py3 easier, and I do not really understand why that is re-introduced. As in, who in their right mind added a dependency that still needs six? That is something worth checking out.

irc depends on tempora, which now depends on python-dateutil, which is most likely the only remaining package I know that is still compatible with Python 2.7. Lol. And they didn't make their six dependency depend on any version. So yeah ... we have that going for us :P

[LordAro]

My method was:

uv venv --python 3.8
uv pip install -r requirements.base
uv pip freeze > requirements.txt
# brief diversion with https://github.com/astral-sh/uv/issues/9550
pip freeze > requirements.txt

I imagine all the "unnecessary" libraries and older versions are due to the older python version (which I used as it's what's used in testing)