Adjust requirements file and dependabot versioning strategy

[ravi-kumar-pilla]

Description

Resolves #1967

Development notes

• Following the doc mentioned here , the dependabot versioning-strategy widen would include both the new and old versions when possible, allowing users the flexiblility to install Kedro-Viz. Unfortunately, the pip ecosystem does not support widen. We will use auto (which is widen for libraries)
• Relaxed the allowed versions in requirements.txt file to have a range with upper-bound corresponding to a major release of the package (which corresponds to a non-backward compatible change, hence needs more attention when upgrading).

QA notes

• No change in the app behavior
• All tests should pass
• Try installing Kedro-Viz and prefect>=3.0.0rc10. This should not raise any issues as mentioned in Relax dependabot strategy #1967 . Note that there is an issue with watchgod not having support for anyio >= 4 and prefect >=3.0.0rc10 requires anyio >= 4. There is an open discussion in watchgod.

Checklist

• Read the contributing guidelines
• Opened this PR as a 'Draft Pull Request' if it is work-in-progress
• Updated the documentation to reflect the code changes
• Added new entries to the RELEASE.md file
• Added tests to cover my changes

[astrojuanlu]

This might be bad docs though:

The service currently does not accept that users configure the widen strategy in their configuration file.

However, we do have widen support in Python, since it's the default strategy used for libraries.

dependabot/dependabot-core#6630

So auto + pyproject.toml = widen.

We might see progress on this soon though? dependabot/dependabot-core#6630 (comment)

The alternative is to merge #1766 and then migrate the dependencies to pyproject.toml. But probably that has implications for CI etc.

[ravi-kumar-pilla]

So auto + pyproject.toml = widen.

Interesting ! Thanks for that

The alternative is to merge #1766 and then migrate the dependencies to pyproject.toml. But probably that has implications for CI etc.

For this sprint, shall we merge #1766 and this PR having the dependabot versioning-strategy as auto with some changes to requirements.txt. I will open a separate ticket to deal with migrating requirements.txt completely to pyproject.toml ? @astrojuanlu

Thank you

[astrojuanlu]

Sounds good!