Update pinned dependencies

[victorlin]

Dependencies are pinned to reduce the need for urgent code compatibility updates on every breaking change from a dependency. We should still be keeping the code compatible with latest versions of dependencies, just at our own pace. Otherwise Augur will become hard to install in environments where users prefer to use latest versions of these dependencies.

This issue aims to go through the list once, but this should be done regularly.

Tasks

• [x] networkx v3 #1534
• [x] xopen v2 #1532
• [ ] numpy v2 #1504
• [ ] pandas v2 #1473
• [ ] jsonschema v4 #1358
• [ ] add more

References

• Slack discussion

[corneliusroemer]

We could potentially look into dependabot for pip, but first we'd have to migrate away from setup.py towards pyproject.toml - maybe not a bad idea for the long run, but I don't know what side effects/downsides there might be.

https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#pip-and-pip-compile

setup.py is not supported by dependabot.

[corneliusroemer]

Actually I might be wrong - setup.py is potentially supported: https://github.com/nextstrain/augur/network/dependencies

From simonw: https://til.simonwillison.net/github/dependabot-python-setup

The Dependabot setup instructions don't explicitly mention projects which keep all of their dependency information in setup.py.

It works just fine with those kinds of projects too.

To start it working, create a file in .github/dependabot.yml with the following contents:

version: 2
updates:
- package-ecosystem: pip
  directory: "/"
  schedule:
    interval: daily
    time: "13:00"
  groups:
    python-packages:
      patterns:
        - "*"