Dependency updates using Dependabot

[Kumar Aditya (kumaraditya303)]

It would much more easier to maintain dependencies using Dependabot than using a custom script. I can take this up. Eric Traut (@erictraut)

[Eric Traut (erictraut)]

I already receive dependabot updates for this repo. In any case, I'd want input from Jake Bailey (@jakebailey), since he's responsible for creating the build infrastructure for this repo and for pylance.

[Jake Bailey (jakebailey)]

The script is important to consistently update our monorepos (we have nested monorepos and many packages, more than you can see in this repo) and to ensure we don't update specific modules like LSP or VS Code APIs that take more care to prevent breakage. I'm already not a huge fan of using dependabot as we do now due to the fact that it usually just bumps up locks (and then we get desync in Pylance as we can't run certain things there).

I appreciate the thought, but in this case I don't think it's necessary. I already frequently update our dependencies in a way that gets everything even. Perhaps it has seemed like nothing was moving because I've been out 🙂

I don't think that we'll really be able to do much better than this until the next monorepo refactoring where the aging lerna can go away (e.g., to switch to yarn 2 with a plugin to help us deal with nested monorepos, or pnpm, etc).