[hma] Version and dependency management discussion

[marielpovolny]

Creating an issue to track discussion around version dependency management and pinning versions in HMA.

We've had some test failures on fresh installs when dependencies have breaking changes. There's existing guidance in CONTRIBUTING.md, but wanted to open this up for broader discussion.

@Dcallies @ThisIsMissEm @juanmrad

[Dcallies]

More context: There is a lively debate about whether we should be pinning versions for pytx and HMA. The current dependency management strategy is that versions are unpinned, but frozen during HMA production image creation.

Pros

• We automatically get security updates whenever we build a new version of HMA
• We benefit from non-breaking version bumps without additional effort

Cons

• Breaking dependency changes are exposed to new contributors, often discovered during CI run on their PRs
• Contributors with long-running checkouts or devcontainers must run pip upgrade (this might still be true even if versions were pinned)

Other than pin/do not pin, there are more possible solutions that are better than this dichotomy. One such practice is using dependabot: https://docs.github.com/en/code-security/getting-started/dependabot-quickstart-guide

When configured properly, new versions of packages will cause a PR to be created which will confirm they do not break CI, which can then be merged.