From 799c99e0cf77d2289ab47e84fa3b8296cfc5beb1 Mon Sep 17 00:00:00 2001 From: Jon Gjengset Date: Sun, 7 Jul 2024 10:18:50 +0200 Subject: [PATCH] Revert "More intelligent dependabot behaviour" This reverts commit dcf68836181145511a35a269e8392d0a0f0c61e1. Will not work due to https://github.com/dependabot/dependabot-core/issues/10160 --- .github/dependabot.yml | 59 +++++------------------------------------- 1 file changed, 6 insertions(+), 53 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f9d7d1c..d0f091e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,63 +4,16 @@ updates: directory: / schedule: interval: daily - # Cargo major version update notifications (PRs) we always want - package-ecosystem: cargo directory: / + schedule: + interval: daily ignore: - dependency-name: "*" + # patch and minor updates don't matter for libraries as consumers of this library build + # with their own lockfile, rather than the version specified in this library's lockfile + # remove this ignore rule if your package has binaries to ensure that the binaries are + # built with the exact set of dependencies and those are up to date. update-types: - "version-update:semver-patch" - "version-update:semver-minor" - schedule: - # we want to know about them immediately - interval: daily - groups: - # we group major bumps for dev-dependencies together in case there are - # related groups of breaking changes. that _can_ be the case for - # production dependencies too, but there one should be more diligent - # about each major bump in case it constitutes a breaking change to the - # current crate too. - major-dev: - dependency-type: "development" - update-types: - - "major" - # patch and minor updates don't matter for libraries, as consumers of a - # library build with their own lockfile, rather than the version specified in - # this library's lockfile. so for libraries (which is most crates), we should - # never update non-major versions, and so the following rule is disabled by - # default. - # - # if your package has binaries, enable this rule by commenting out the - # `open-pull-requests-limit` line. this will open a PR once a month that - # effectively runs `cargo update` to ensure that the binaries are built with - # the exact set of dependencies and those are up to date. - - package-ecosystem: cargo - # this rule is disabled by default; comment out this line to re-enable: - open-pull-requests-limit: 0 - directory: / - schedule: - interval: monthly - # select only minor + patch by excluding major. dependabot doesn't appear - # to have an include-only rule, so we have to do it by exclusion. - ignore: - - dependency-name: "*" - update-types: - - "version-update:semver-major" - # never bump the version in `Cargo.toml` for minor/patch upgrades; it - # should only change when the major version changes to avoid requiring - # downstream packages from also running a `cargo update` (and possibly - # bumping MSRV unnecessarily as a result). - # - # TODO: https://github.com/dependabot/dependabot-core/issues/4009 - # versioning-strategy: "increase-if-necessary" - versioning-strategy: "lockfile-only" - groups: - # note that since this is perfectly disjoint with the `ignore` rule, all - # minor/patch updates will end up in a single group, and thus in a single - # PR. grouping all of these together only (generally) works because the - # Rust community is fairly good about respecting semver. - cargo-update: - update-types: - - "minor" - - "patch"