Add dependabot for dependency upgrades

[clintonsteiner]

• Use dependabot to update dependencies and GitHub Action versions #341

[akaihola]

Thanks @clintonsteiner!

So does dependabot work fine with packages which use setuptools and setup.cfg? I remember participating in the discussion of dependabot/dependabot-core#2133, but it might be that the issue concerns only the depenedency graph feature on GitHub.

[akaihola]

Can we somehow test this before merging?

Also, a change log entry would be nice.

[clintonsteiner]

https://github.com/clintonsteiner/darker/actions/runs/11605270324/job/32315372582
Testing in fork now appears to work, must enable in code security though

[clintonsteiner]

• implement pyproject.toml for dependencies #767

I'd like to get rid of the constraints-oldest and move to pyproject.toml

I was unable to make dependabot acknowledge both files and seems a pain to manage both

[akaihola]

#767
I'd like to get rid of the constraints-oldest and move to pyproject.toml

I was unable to make dependabot acknowledge both files and seems a pain to manage both

I noticed you closed #767 – did you find a work-around?

I wanted to move away from setup.cfg as well, and uv nowadays provides --resolution=lowest, equivalent to what I've used constraints-oldest.txt for.

But: Due to missing raw HTML support on PyPI, we still depend on setup.py to strip the contributor table from README.rst in the distribution packages. This is the only reason we're still using setup.py and setup.cfg. I've been looking into different ways of solving this (e.g. configuring PyPI or GitHub to use a different file for the project front page), but haven't found an elegant solution yet.