Pin dependencies

[bombsimon]

There's been a couple of times where not pinning dependencies has made either CI or local development pull the latest version and things have been broken. It's also affected result of pylint making linting failing even with no changes to the code.

Relates to #331, #336, #334

I suggest pinning dependencies and introduce a process to controlled upgrade dependencies instead. By doing this we can ensure that the latest main and CI is working until manually upgrading dependencies.

[SzymonFig]

Fixed in MR
In a separate merge request, a dependency update tool will be introduced.

[bombsimon]

Hi! I woudn't really say fixed in that MR, it just addresses a related issue. Dependencies are still not pinned so it can likely happen soon again.

I think we can keep this open until dependencies are actually pinned independent of if it's in the current pyproject.toml or after a new tool is introduced. Unless there's a separate issue tracking this of course!

[bombsimon]

I see that #359 landed which fixes a bunch of things related to project management. But still, looking at main branch I see a few issues:

ariadne-codegen/pyproject.toml

Lines 27 to 54 in f566e7e

	dependencies = [
	"click~=8.1",
	"graphql-core>=3.2.0,<3.3",
	"toml~=0.10",
	"httpx~=0.23",
	"pydantic>=2.0.0,<3.0.0",
	"black",
	"isort",
	"autoflake",
	]
	[project.optional-dependencies]
	dev = ["ipdb"]
	test = [
	"ariadne",
	"freezegun",
	"pytest",
	"pytest-asyncio",
	"pytest-httpx",
	"pytest-mock",
	"requests-toolbelt",
	"types-toml",
	"websockets>=14.2",
	"opentelemetry-api",
	]
	types = ["mypy>=1.0.0"]
	subscriptions = ["websockets>=14.2"]
	opentelemetry = ["opentelemetry-api"]

• black and isort are used to format generated files. Old versions (and potential newer ones) can result in different generated code affecting both test generated clients and test results, but also actual user generated files.
• Using ~= on any minor version for non stable (non v1.0) versions can break, that's what happened with httpx
• Not pinning test dependencies can result in bad user experience. When I first started contributing, having diff in result of modules like pytest and type modules can result in failures and time consuming troubleshooting
• nit: Mix of syntax(?) Afaik, >=3.2.0,<3.3 is the same as ~=3.2.0 and >=2.0.0,<3.0.0 is the same as ~=2.0 ref

I get you don't want to add extra maintenance and have to bump dependencies all the time but having reproducible executions at any commit is nice and knowing tests and codegen will pass no matter how long since the last commit and pipeline run helps contributors (and users of the codegen).