Resolve Python dependency PRs

[tynandebold]

Description

We have a number of open dependabot PRs that we should resolve. They are:

• Update fastapi[all] requirement from <0.96.0,>=0.73.0 to >=0.73.0,<0.102.0 in /package #1483
• Bump aiofiles from 22.1.0 to 23.2.1 in /package #1518
• Update matplotlib requirement from ~=3.5 to ~=3.8 in /package #1546
• Update uvicorn[standard] requirement from ~=0.22.0 to ~=0.23.2 in /package #1547
• Bump pillow from 9.3.0 to 10.0.1 in /demo-project/src/demo_project/pipelines/reporting #1552
• Update kedro-datasets[pandas.csvdataset,pandas.exceldataset,pandas.parquetdataset,plotly.jsondataset] requirement from <1.7.1,>=1.0 to >=1.0,<1.7.2 in /package #1561

This issue should only be closed when all of those PRs are closed, either by merging and accepting the update or closing them because they're not needed.

Checklist

• Include labels so that we can categorise your issue

[astrojuanlu]

Comment from the peanut gallery: since Kedro-Viz dependabot is using the default configuration, versioning-strategy is set to auto, meaning

Try to differentiate between apps and libraries. Use increase for apps and widen for libraries.

https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#versioning-strategy

and since Kedro-Viz uses requirements.txt for its Python requirements, it's probably applying the increase strategy, which is arguably too aggressive for a component like Kedro-Viz. In fact, since Kedro switched to pyproject.toml, dependabot PRs have been using the widen strategy.

Viz can either

• Do nothing and keep aggressively upgrading dependencies, but this can lead to problems with people that have environments with lots of dependencies.
• Configure dependabot to use widen.
• Migrate dependencies to pyproject.toml Move to pyproject.toml #1527 and keep the auto config.

[tynandebold]

Thanks for the input. I think we'll go with your third bullet point above (Migrate dependencies to pyproject.toml). I've pulled that issue into this sprint now, so when that's done I hope these upgrades quiet down a bit.

[MehdiNV]

The pyproject.toml ticket may take a while due to its complexity, so going to progress this ticket forward so that it's not blocked