Document policy for pinning / upper+lower bounding dependencies

[JamesKunstle]

Across our project we have upper and lower bounds on dependencies. In general, we try to minimize and avoid conflicts between the version requirements of the libraries and the CLI. We should have a consistent policy for:
(1) under what circumstances we pin dependencies and
(2) under what circumstances (default?) we upper-bound dependencies.

[JamesKunstle]

@tiran

[nathan-weinberg]

This should be part of #1758

I also have a Dev Doc open relevant to this: instructlab/dev-docs#125

[github-actions]

This issue has been automatically marked as stale because it has not had activity within 90 days. It will be automatically closed if no further activity occurs within 30 days.

[nathan-weinberg]

@courtneypacheco @ktdreyer would either of you be interested in taking this on? It has come up in a few related issues, such as #2576 and #3164

[booxter]

My take is the default should be unpinned / un-upper-capped. We should cap and pin only when there's a good justification of why any other version would not work at all. (And then it becomes a tech debt issue to resolve - and remove the pin/cap.)

What we'll need to have this implemented is a constraints system for versions tested in CI. It's a problem that can be solved with pip constraints files.

[booxter]

There's already https://github.com/instructlab/dev-docs/blob/main/docs/dependency-management.md that covers general practices (e.g. that libraries should not be pinned / capped as a general matter). We just need to follow the official guidance.

[github-actions]

This issue has been automatically marked as stale because it has not had activity within 60 days. It will be automatically closed if no further activity occurs within 30 days.

[github-actions]

This issue has been automatically closed due to inactivity. Please feel free to reopen if you feel it is still relevant!