Update pinned dependencies

[victorlin]

Dependencies are pinned to reduce the need for urgent code compatibility updates on every breaking change from a dependency. We should still be keeping the code compatible with latest versions of dependencies, just at our own pace. Otherwise Augur will become hard to install in environments where users prefer to use latest versions of these dependencies.

This issue aims to go through the list once, but this should be done regularly.

Tasks

• networkx v3 chore(deps): Support networkx major version 3 #1534
• xopen v2 chore(deps): allow xopen major version 2 #1532
• numpy v2 Support numpy major version 2 #1504
• pandas v2 Rollout pandas version 2 #1473
• jsonschema v4 Augur errors when jsonschema version 4 is installed #1358
• Do this programmatically: chore(deps): configure dependabot for pip deps #1538

References

• Slack discussion

[corneliusroemer]

We could potentially look into dependabot for pip, but first we'd have to migrate away from setup.py towards pyproject.toml - maybe not a bad idea for the long run, but I don't know what side effects/downsides there might be.

https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#pip-and-pip-compile

setup.py is not supported by dependabot.

[corneliusroemer]

Actually I might be wrong - setup.py is potentially supported: https://github.com/nextstrain/augur/network/dependencies

From simonw: https://til.simonwillison.net/github/dependabot-python-setup

The Dependabot setup instructions don't explicitly mention projects which keep all of their dependency information in setup.py.

It works just fine with those kinds of projects too.

To start it working, create a file in .github/dependabot.yml with the following contents:

version: 2
updates:
- package-ecosystem: pip
  directory: "/"
  schedule:
    interval: daily
    time: "13:00"
  groups:
    python-packages:
      patterns:
        - "*"