[Bot] Update dependencies - #1625

(When it’s ready) Patch release, please! :) The last release was a minor release, causing all the vX.Y pins to get bumped by dependabot, but it didn't add or remove Python versions and didn't change anything that used to work, making it feel like a patch release.

Arguably the problem really is that we should have made major releases when platforms change, and we’d be at version 30 or something.

Could this be merged and a new release be tagged? It would be nice to build wheels with rc3.

(When it’s ready) Patch release, please! :) The last release was a minor release, causing all the vX.Y pins to get bumped by dependabot, but it didn't add or remove Python versions and didn't change anything that used to work, making it feel like a patch release.

v2.16.0 added new features, so it gets a minor release, that's always been my rule. I know what you mean, though, the dependabot updates are noisy. Maybe there's something we can do to better support that. I actually feel inclined to make a vX moving tag too, some of my projects don't really care much about repeatability.

If someone wants no pinning, they can just use pipx run cibuildwheel. The point of the action is the pinning. The thing that does break most users on updates is adding new Python versions (3.12), maybe new PyPy versions (PyPy3.10), new platforms (like musllinux), and removing old platforms. It's extremely helpful to pin on that. Adding new API doesn't break anyone since they aren't using it yet - normally this would be "minor" release criteria, but since we guarantee a new minor release for addition/removal of platforms, I'm saying it's possibly helpful to consider it a patch release. And we don't really make breaking API changes much (which is our "major" release criteria).

Now if we bumped the major version on every removal/addition, then we could make new features minor releases and bug fixes patch releases. But we'd have new major versions at least yearly, and maybe every few months.

I'm mostly worried about concerns like #1587; personally I get enough update PRs that this isn't a large enough fraction to worry about.