Package dependency guidelines

[RobPasMue]

Coming from ansys/pyansys#842 (comment) we realized that this information is not published anywhere. We should clarify better how packages should handle dependencies for various purposes - just like @greschd outlined there.

[greschd]

TODOs:

• CI / CD must use pinned dependencies. Provide examples using uv (with flit or hatch), poetry.
• Create guidance about version range upper limits (only when absolutely necessary / known incompatibility exists)
• Provide SBOM files on releases (only for shipped dependencies incl. extras, not for dev-only dependencies) this information will be outdated immediately, so does not provide any value
• Provide setup examples for dependabot on the lockfile (with CVE alerts).
• Add guidance on creating releases: when a CVE update requires modifying the dependency version range, a release should be created
• Create an SBOM alongside the create-wheelhouse action
• Create a security practice / timeline statement. Should this also include how to deal with archiving unsupported libraries of our own?

[da1910]

Add guidance on creating releases: when a CVE update requires modifying the dependency version range, a release should be created

I cannot recall what we decided here in the end. If we are only releasing by tagging main as we go then this makes sense, if you have to update a version range to extend support to a new version with a fix this means a release so users can get a non-vulnerable version.

If we have multiple release branches, does this mean we intend to keep dependencies for all of these up to date? Can we even do that with dependabot?

[greschd]

If we have multiple release branches, does this mean we intend to keep dependencies for all of these up to date? Can we even do that with dependabot?

I think it's only feasible to do this on the main branch.

We did discuss that if the metapackage and / or downstream app developers cannot match non-vulnerable versions (using our release), they can provide another signal that a new release might be required.