refactor: Centralize Vega project versioning

[dangotbanned]

Description

This PR seeks to simplify version bumps of projects we depend on within the https://github.com/vega org.

The new process I'm proposing is documented in https://github.com/vega/altair/blob/5aec51ef8eaf345936436abddd903ea87b86b968/NOTES_FOR_MAINTAINERS.md.
In short, we bump versions in pyproject.toml and they propagate to everywhere they were previously manually maintained:

altair/pyproject.toml

Lines 103 to 110 in 5aec51e

	[tool.altair.vega]
	# Minimum/exact versions, for projects under the `vega` organization
	vega-datasets = "v2.11.0" # https://github.com/vega/vega-datasets
	vega-embed = "6" # https://github.com/vega/vega-embed
	vega-lite = "v5.20.1" # https://github.com/vega/vega-lite
	vegafusion = "1.5.0" # https://github.com/vega/vegafusion
	vl-convert-python = "1.7.0" # https://github.com/vega/vl-convert

The new module https://github.com/vega/altair/blob/5aec51ef8eaf345936436abddd903ea87b86b968/tools/versioning.py handles said propagation.

Motivation

Vega-Lite

I think it was unintentional, but we missed a vega-lite bump in https://github.com/vega/altair/releases/tag/v5.5.0.
We're still on https://github.com/vega/vega-lite/releases/tag/v5.20.1 but we should be on https://github.com/vega/vega-lite/releases/tag/v5.21.0 and now the latest is https://github.com/vega/vega-lite/releases/tag/v5.23.0

Additionally, these appear to be out-of-sync?

vl-convert

altair/pyproject.toml

Lines 56 to 58 in 1208c5d

	[project.optional-dependencies]
	save = [
	"vl-convert-python>=1.7.0",

altair/altair/utils/_importers.py

Lines 47 to 48 in 1208c5d

	def import_vl_convert() -> ModuleType:
	min_version = "1.6.0"

VegaFusion

altair/pyproject.toml

Line 66 in 1208c5d

"vegafusion[embed]>=1.6.6",

altair/altair/utils/_importers.py

Lines 12 to 13 in 1208c5d

	def import_vegafusion() -> ModuleType:
	min_version = "1.5.0"

Future

I'm planning to pin vega-datasets for (#3631).

There are also likely to be a lot of version changes coming up as a result of (vega/vega#3990).
IMO having a single, highly visible place to update will make this process hopefully painless for us

Tasks

• Work-around for tomllib when sys.version_info < (3, 11)
  • See (https://github.com/vega/altair/actions/runs/12456841158/job/34770747096?pr=3720)
• Update RELEASING.md (dc0215c)
• Update NOTES_FOR_MAINTAINERS.md
  • Mostly finished in (c45f1c4)
  • VegaFusion advice (thread)

[dangotbanned]

@jonmmease do you have any thoughts on what should go here?

AFAIK we haven't documented this before - but it seems like something that would be helpful if you weren't available

[jonmmease]

The VegaFusion constraint isn't tied to the Vega-Lite version (since VegaFusion works at the Vega level). In theory it could be connected to the Vega version, but Vega has been so stable that this hasn't come up in practice.

I think the VegaFusion version constraint is determined by the API we depend on, just like a regular Python dependency.