pyup updates

[jekel]

Hello!
It is possible to configure pyup-bot to not automatically update minimal required SQLAlchemy version?

[wwwjfy]

I've been thinking about it too, that use >= a minimum version for libraries in requirements.txt.

But @jekel could you tell us your situation? Are you using an old version of SQLAlchemy and a new version of Gino together? That's the only case I think of, i.e. Gino is not the only ORM being used in a (big) project.

[jekel]

Are you using an old version of SQLAlchemy and a new version of Gino together?

the point is, to not update another project dependency - SQLAlchemy every time when GINO is updated also

@wwwjfy the best solution, i think, is to use >= for minimum required version that correctly works, it will be very helpful for big projects, and small also :)

[wwwjfy]

If SQLAlchemy is not used in the project, it's unnecessary to specify in the requirement, I usually just use tools like pip or pipenv to update dependencies, and indirect dependencies get installed/updated automatically.
How is that an issue for you? Trying to figure out the pain point.

[wwwjfy]

There are benefits to automatically update dependencies. The biggest one IMO is if there is any security issue, we don't need to follow every release and check the changelog to decide if that should be included.

[jekel]

We are using both GINO + SQLAlchemy in requirements, and i'm afraid that in one of releases of SQLAlchemy there can be some backwards incompatibility, security issues, etc...