add workflow for freezing and updating dependencies

[j5awry]

ATM we have a combination of frozen, ranges, and "latest" in our requirements files. We also have no workflow for updating dependencies and doing testing. As such, some of our frozen deps are a bit behind, and our ranges may not be up to date. Ex: Flask is currently >0.8 but we may want to start forcing the 1.0 fork

We need an automated way to do the following

• check dependencies are reasonably up to date
• test against latest versions of dependencies
• test ranges of dependencies if we are going to allow specific ranges
• automatically update dependencies for releases

[j5awry]

bonus points -- integrating OSV scans

Add ossaudit to audit Python packages for known vulnerabilities: https://github.com/illikainen/ossaudit

[ziirish]

I'll have a look at dependabot

This could help us automate the upgrade of our dependencies

[sloria]

FWIW, I'm using dependabot for the marshmallow libs and my other OSS and have been pretty happy with it. We're using Renovate at work, which allows batching multiple upgrades into a single PR, on a schedule. This is nice for applications with lots of deps, but perhaps less important for libraries. I can recommend either of these.

[SVilgelm]

Dependabot works great. We just need to rename *.pip files to *.txt. Here is I renamed the files: SVilgelm@d9b44cb
and got 10 pull requests from the bot: https://github.com/SVilgelm/flask-restx/pulls

[SVilgelm]

Anyone know what is a purpose to have 2 requirement files for documentation?:

• requirements/doc.pip
• readthedocs.pip

@ziirish what file is set in the readthedocs settings for flask-restx project?

[SVilgelm]

@ziirish to prepare the PR for Dependabot, I need to know, should we rename the readthedocs.pip or no? Could you check the readthedocs settings? Does it use readthedocs.pip file? If yes, then we can remove the requirements/doc.pip file in favor of readthedocs.pip

[SVilgelm]

or I would recommend to set the requirements/doc.pip in the readthedocs settings

[SVilgelm]

So, we need to drop off the support for py2.7 and py3.4 otherwise it requires the extra requirements to be added, like:

Faker==3.0.1; python_version < '3'
Faker==4.0.0; python_version >= '3'
mock==3.0.5; python_version < '3'
mock==4.0.1; python_version >= '3'
pytest==4.6.5; python_version < '3.5'
pytest==5.3.5; python_version >= '3.5'