📌(backend) pin all packages

Currently some packages are not pinned and this may lead to introduce bugs
during deployment that we are not able to detect during development phase
that is really weird. As richie is a library package, we cannot pin
exactly all deps but to prevent to deploy silently packages containing
breaking changes, we use a stragegy to install only minor and patch
versions of all packages. Major versions will be upgraded by renovate.

pyproject.toml

@@ -28,27 +28,27 @@ classifiers = [
 ]
 requires-python = ">=3.8"
 dependencies = [
-    "arrow",
+    "arrow<2",
     "Django<5",
-    "djangocms-file",
-    "djangocms-googlemap",
+    "djangocms-file<4",
+    "djangocms-googlemap<3",
     "djangocms-link>=5.0.0,<6",
-    "djangocms-picture",
-    "djangocms-text-ckeditor",
-    "djangocms-video",
-    "djangorestframework",
-    "django-autocomplete-light==3.11.0",
+    "djangocms-picture<5",
+    "djangocms-text-ckeditor<6",
+    "djangocms-video<4",
+    "djangorestframework<4",
+    "django-autocomplete-light<4",
     "django-cms>=3.11.0,<4.0.0",
-    "django-parler>=2.3",
-    "django-redis>=4.11.0",
-    "django-treebeard",
-    "dj-pagination",
-    "easy_thumbnails[svg]>=2.8",
+    "django-parler>=2.3,<3",
+    "django-redis>=4.11.0,<6",
+    "django-treebeard<5",
+    "dj-pagination<3",
+    "easy_thumbnails[svg]>=2.8,<3",
     "elasticsearch>=6.0.0,<7.0.0",
-    "exrex==0.12.0",
-    "importlib-metadata",
-    "oauthlib==3.2.2",
-    "requests==2.32.3",
+    "exrex<1",
+    "importlib-metadata<9",
+    "oauthlib>=3.2.2,<4",
+    "requests>=2.32.3,<3",
 ]
 
 [project.urls]