Ping @lesteve @rth

Though in general, I think it might be nice to move to a model that I've seen work elsewhere: always pinning versions, but having a bot propose to change the requirements when a new version is released...... (I've seen dependabot and pyup-bot do this. I'm sure there are several options.) This has the benefit that we can evaluate each new dependency release quickly, but it doesn't break PRs.

I'm completely agreeing and I would be inclined to have a bot for that. For instance, we pinned the version of numpydoc and sphinx-gallery because of some bugs at the time but completely forgot to revert it meaning that we are not benefiting from the latest improvement for building the documentation.

Can we merge this PR and open an appropriate PR to automate some of the build?

Looks like Dependabot is the way to go since it was acquired by github and can be configured directly on github: https://dependabot.com/blog/hello-github/

But from what I understand, these bots update requirements.txt files. If this is the case, we need our "*.yml" file to use those (at least for the pip-latest or conda-latest)

I think we can include .dependabot/config.yml with a directory key to configure the bot to look at a specific folder. In our case, we can create a requirements.txt file just for the doc in doc folder and have the bot focus on that folder.

Reference: https://dependabot.com/docs/config-file/

thanks @glemaitre