Add dependabot to software stack

[mmcky]

Anyone had experience using:

https://dependabot.com

Seems to be a github product and might trigger more regular updates as dependencies are updated. Thoughts?

[choldgraf]

+1 from me - I guess it would just open a PR anyway so we can make sure the tests pass. I think it could make it easier to upgrade all the parts of the stack quickly

[mmcky]

+1 from me - I guess it would just open a PR anyway so we can make sure the tests pass. I think it could make it easier to upgrade all the parts of the stack quickly

Yeah I guess that's half my concern lots of PR proliferation. I've typically battled conda-forge automation. I mean it's awesome but take learning.

[choldgraf]

yes - maybe we can time-box it on one or two repositories and see how it has worked, and then adopt more widely if we like it?