Although this project contained a file named conda-environment.yml.lock it turns out that this wasn't being used when creating the environment. The result was that dependent packages of those mentioned in conda-environment.yml were able to be installed.
This hit us on the deploy of version 0.0.13 when a major version upgrade of sqlalchemy caused the jupyterhub-conda service to break, two weeks after the deployment of the upgraded package.
This commit updates the Dockerfile that is used to build the package, so that it correctly uses the conda-environment.lock.yml file when creating the initial environment.
It also copies some utility scripts from the airflow-dags repository, where the process has been working successfully, and updates the documentation to reflect the new process for upgrading.
Two minor changes to the environment.lock.yml files were required, one because a particular version of the ipykernel package was unavailable and another to specify the GitHub URL of wmfdata.