Keeping track of dependencies

[asmodehn]

Gryphon has a lot of dependencies. We should look around for a service to help us manage them (I m thinking of something like https://pyup.io/ but dont have any strong preference).

The goal is to get an automatic pull request when a new version of dependency is available, so we can quickly decide if we want to upgrade or not (based on our PR build result). This helps to remain in control of our dependencies, stay close to the latest versions with minimum effort, and makes mandatory manual upgrades less painful (as all transitive dependencies usually have been upgraded previously).

Thoughts ?

[garethdmm]

I'm open to this. Are there any comparisons of different services you're aware of?

I assume this would also need us to have much better test coverage right now. Right now a green PR build doesn't necessarily mean that everything works perfectly.

[asmodehn]

I am not aware of any comparison for this. I had this need for my python projects a while ago, and eventually decided on https://pyup.io at the time.

Indeed, we should strive for tests coverage and completeness, and get a "reasonable-enough" coverage first.