Add dependabot for dependency upgrades

[clintonsteiner]

#341

[akaihola]

Thanks @clintonsteiner!

So does dependabot work fine with packages which use setuptools and setup.cfg? I remember participating in the discussion of dependabot/dependabot-core#2133, but it might be that the issue concerns only the depenedency graph feature on GitHub.

[akaihola]

Can we somehow test this before merging?

Also, a change log entry would be nice.

[clintonsteiner]

https://github.com/clintonsteiner/darker/actions/runs/11605270324/job/32315372582
Testing in fork now appears to work, must enable in code security though

[clintonsteiner]

#767
I'd like to get rid of the constraints-oldest and move to pyproject.toml

I was unable to make dependabot acknowledge both files and seems a pain to manage both

[akaihola]

What, did dependabot claim there are vulnerabilities in older versions of Black?

[akaihola]

I do see a CVE security vulnerability in Black 24.3.0 though. But I couldn't find anything before 24.1.0 which would have been fixed in that version.

I guess it makes sense to drop support for Black <24.3.0, but on the other hand I wouldn't like to break users' workflows if they for any reason choose to pin to a selected Black version. And if the code they are formatting is all internal and trusted, I think that's a valid decision.

What do you think?

[akaihola]

I wonder how dependabot will react to dependencies in extras – Black will be moved there in #759.

[clintonsteiner]

It tried to update the constraints-oldest.txt file but left the setup.cfg alone

Think we need to have dependencies defined only in one spot for dependabot

[akaihola]

#767
I'd like to get rid of the constraints-oldest and move to pyproject.toml

I was unable to make dependabot acknowledge both files and seems a pain to manage both

I noticed you closed #767 – did you find a work-around?

I wanted to move away from setup.cfg as well, and uv nowadays provides --resolution=lowest, equivalent to what I've used constraints-oldest.txt for.

But: Due to missing raw HTML support on PyPI, we still depend on setup.py to strip the contributor table from README.rst in the distribution packages. This is the only reason we're still using setup.py and setup.cfg. I've been looking into different ways of solving this (e.g. configuring PyPI or GitHub to use a different file for the project front page), but haven't found an elegant solution yet.