Repository: Cloud-CV/EvalAI
Issue: Add integration with Dependabot

### The problem:
Updating dependencies is a repetitive need. However, it is not feasible for a person to keep an eye on all updates on dependencies. As a result, the outdated dependencies keep piling up. A need for a remediation on this was felt while working on this: https://github.com/Cloud-CV/EvalAI/pull/2627

### The solution:
The process of updating dependencies can be automated easily with bots.
[Dependabot](https://dependabot.com/) is a great tool for this purpose. It automatically checks for updates in dependencies periodically in specified frequency (e.g. daily or weekly). Then it opens up PRs bumping those dependencies. We can verify that the updates are compatible by taking feedback from CI pipeline (Travis).

According to the [`requires.io` report](https://requires.io/github/Cloud-CV/EvalAI/requirements/?branch=master), most dependencies in EvalAI are already outdated. I think the mentioned approach will be a really efficient way to keep dependencies up-to-date and avoid having to make large version bumps in dependencies later on.

### Example:
I integrated dependabot on my fork of evalai-cli and here are some sample pull requests:
* https://github.com/nikochiko/evalai-cli/pull/11 (Updating botocore)
* https://github.com/nikochiko/evalai-cli/pull/10 (Updating Click)

Note that here for the click upgrade, travis CI fails due to some API changes in the versions, this can be noted and the required changes in API can be made to make the update possible.

@nikochiko Can I work on it?

@nikochiko if dependabot isn't integrated then how this pr was created https://github.com/Cloud-CV/EvalAI/pull/2466 i cant understand?

@Suryansh5545 Nice catch :+1: I missed that PR. I think you are right, we do have integration with dependabot.
But I'll still keep this issue open as there are many outdated dependencies, and like the issue I mentioned above (PR #2627) it could cause unnecessary problems. 

@Tanuj22 Only people with write access to the repo can configure dependabot iirc. Feel free to take up another issue tho! Happy hacking. :smile:

Also the PR you mentioned (#2466) is the only one opened by dependabot. Maybe the PRs are infrequent due to some configuration settings. 

@nikochiko , Yea I saw that myself. But there might be some reason developers have its frequency reduced.  They have integrated it well in cloudcv website repo.

I think it might be bit annoying seeing many pr being created.  Also the dependabot bot didn't test for the changes in frontend I recently update some dependencies in my own repo for test and it deformed the frontend.

Yes I am aware that it might have been done deliberately. 
But I still have the opinion that having a bot handle the dependencies (however annoying) will be a good addition overall.  I am hoping to have a discussion with the maintainers or the mentors in the know about the same. So that way we can discuss the issues and come to a definite conclusion. 

We need to take feedback from a robust CI pipeline to make sure that the update doesn't break anything. With a trial run on local environment we can be sure that the build is good to go. 

(But that is what we do for all PRs not just version bumps :smile:)

We already have dependabot and the issue of the outdated requirement is similar to #2564