Robottelo: Freeze dependencies

[rochacbruno]

We have discussed that in the past in #3423

But I am raising this question again because today we faced the same issue again in automation.

External dependency upgraded and broke our automation.

So I am raising the idea of pinning all deps versions and then use https://pyup.io to notify us of upgraded deps (it includes changelog and we can test the dep before merging)

[renzon]

+1 for dependencies pinning. Manually upgrading dependencies allow us finding regression because of lib upgrade. More then that, it keep us from to figure it out on builds that de dependency was the problem and not our code.

[elyezer]

I continue thinking that master should always use the latest. But we can pin whenever we come to the point we have a release to deliver, that will help stabilize the dependencies and all failures be automation failures and not framework failures.

The main concern is to make sure we adapt our code from time to time to get all updates, if pyup.io can help on not forgetting to do that then we can use it and pin versions.

[rochacbruno]

@elyezer I'll work on this, maybe your help will be needed to setup pyup hooks.

[elyezer]

@rochacbruno sure, please let me know what I need to do.

[omaciel]

Speaking of pinning, can we update the version of selenium? Running UI tests locally fail with newest firefox so I always bump it... we would have to check our docker images too I guess, to make sure that our auto can continue to work with it...

[rochacbruno]

@omaciel I remember we had one issue with scrolling in the new selenium, I need to check it

[rochacbruno]

implemented