mirror of
https://github.com/pgadmin-org/pgadmin4.git
synced 2026-08-17 16:34:44 -05:00
Dave Page
7790264acb
We were carrying 27 open Dependabot PRs, the great majority of them single patch bumps of transitive packages, and the review cost of that queue is entirely out of proportion to its risk. Every genuine problem found whilst clearing it (paramiko 5.0 breaking sshtunnel, use-resize-observer 10.0 dropping its default export, jest-dom 7.0 requiring a newer Node) was a major bump. Group minor and patch updates into a single weekly PR per manifest, and leave major updates arriving individually so each still gets its own review. Grouping applies to version updates only, so security updates are unaffected and continue to arrive as separate PRs.
111 lines
2.9 KiB
YAML
111 lines
2.9 KiB
YAML
version: 2
|
|
|
|
# A note on the "groups" blocks below: minor and patch updates are batched into
|
|
# a single PR per manifest per week, whilst major updates continue to arrive
|
|
# individually. Majors are where the breakage lives and each one wants its own
|
|
# review, whereas a dozen separate PRs for patch bumps is pure overhead.
|
|
# Grouping applies to version updates only, so Dependabot security updates are
|
|
# unaffected and still arrive as their own PRs.
|
|
updates:
|
|
- package-ecosystem: "docker"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
labels:
|
|
- "Dependencies"
|
|
commit-message:
|
|
prefix: "Docker dependency"
|
|
|
|
- package-ecosystem: "pip"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
labels:
|
|
- "Dependencies"
|
|
commit-message:
|
|
prefix: "Python dependency"
|
|
groups:
|
|
python-minor-and-patch:
|
|
patterns:
|
|
- "*"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
# paramiko 5.0 removed DSSKey, which sshtunnel 0.4.0 still references in
|
|
# SSHTunnelForwarder.get_keys(); a major bump therefore breaks every SSH
|
|
# tunnelled connection at construction time. sshtunnel has had no release
|
|
# since 2019, so this stays put until it is fixed or replaced. See #9927.
|
|
ignore:
|
|
- dependency-name: "paramiko"
|
|
update-types: ["version-update:semver-major"]
|
|
|
|
- package-ecosystem: "pip"
|
|
directory: "/tools"
|
|
schedule:
|
|
interval: "weekly"
|
|
labels:
|
|
- "Dependencies"
|
|
commit-message:
|
|
prefix: "Python dependency"
|
|
groups:
|
|
tools-python-minor-and-patch:
|
|
patterns:
|
|
- "*"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
|
|
# Note that web/regression/requirements.txt begins with
|
|
# "-r ../../requirements.txt", so this entry also sees everything pinned in
|
|
# the root file and the paramiko exclusion has to be repeated here.
|
|
- package-ecosystem: "pip"
|
|
directory: "/web/regression"
|
|
schedule:
|
|
interval: "weekly"
|
|
labels:
|
|
- "Dependencies"
|
|
commit-message:
|
|
prefix: "Python dependency"
|
|
groups:
|
|
regression-python-minor-and-patch:
|
|
patterns:
|
|
- "*"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
ignore:
|
|
- dependency-name: "paramiko"
|
|
update-types: ["version-update:semver-major"]
|
|
|
|
- package-ecosystem: "npm"
|
|
directory: "/runtime"
|
|
schedule:
|
|
interval: "weekly"
|
|
labels:
|
|
- "Dependencies"
|
|
commit-message:
|
|
prefix: "Javascript dependency"
|
|
groups:
|
|
runtime-javascript-minor-and-patch:
|
|
patterns:
|
|
- "*"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
|
|
- package-ecosystem: "npm"
|
|
directory: "/web"
|
|
schedule:
|
|
interval: "weekly"
|
|
labels:
|
|
- "Dependencies"
|
|
commit-message:
|
|
prefix: "Javascript dependency"
|
|
groups:
|
|
web-javascript-minor-and-patch:
|
|
patterns:
|
|
- "*"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|