fix/outdated deps

[baywet]

• fix: version requirement for httpx
• fix: dependabot configuration for new project structure

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[andrueastman]

I believe there's a conflict with #387

[github-actions]

This pull request has conflicting changes, the author must resolve the conflicts before this pull request can be merged.

[baywet]

@andrueastman yes, I believe we identified the problem at about the same time. We have a bunch of outdated dependencies in the toml files. (not sure whether it's a regression, old repos used the requirements file)

Also from looking at the dependabot documentation
And the toml specification it's possible our projects are behind (no project section, missing dependencies, using poetry dependencies, etc...) what do you think?

[andrueastman]

Just checking in here. Any chance this is still an issue after the dependabot PRs?
#389

I believe dependabot should be able to handle the poetry deps. as it is listed in below.
https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/dependency-graph-supported-package-ecosystems#supported-package-ecosystems

I believe the discrepancy was caused by incorectly pulling the version range modifiers from the original projects (using ^ vs >=) but dependabot seems to have fixed that now....

[baywet]

I wasn't sure why we were not getting any dependabot PRs on the toml. I thought it was because of the file "format" but now that we've received a PR I think here is what happened:

1. pre grouping, since we had requirements files, dependabot was updating those and the toml fell behind.
2. after grouping, the directories were wrong, and we removed the requirement files. So we weren't getting dependabot PRs, and the tomls were migrated with "behind dependencies" from their original repos
3. now that the directories are fixes we're getting dependbot PRs.

If this is your understanding as well. I don't think we need to take further action at this point, At least not for the dependabot aspects. Maybe we'll want to mordernize our toml files for other reasons, but nothing pressing as far as I can tell.