Repository navigation
chore: add Dependabot version updates - #78
Merged
Merged
Conversation
The repo had Dependabot alerts but no dependabot.yml, so outdated dependencies were reported but never proposed as PRs. Add weekly updates for cargo (all four manifests), npm, pip and GitHub Actions. Minor/patch updates are grouped per ecosystem; majors get individual PRs. Commit messages use chore(deps) so they don't trigger releases on their own.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The repo shows Dependabot alerts but has no
.github/dependabot.yml, so outdated dependencies are reported but never proposed as PRs. That's how pyo3 (#76) and vitest (#77) fell behind. Theactions/checkout@v4"Node.js 20 is deprecated" warning on every CI run is the same story for GitHub Actions.What
Weekly updates for:
cargopackages/rust(core, crates.io),packages/python(compiled into wheels),packages/rust/wasm(compiled into npm),packages/rust/iosnpmpackages/javascriptpippackages/python(piprather thanuv, becauseuv.lockis git-ignored and Dependabot's uv support needs a committed lockfile)github-actions/chore(deps): …, which follows conventional commits and doesn't trigger a release by itself. When an update has to ship to users (e.g. a security fix in a crate compiled into the wheels, like pyo3), retitle itfix(deps):before merging. This is noted in the file.After merging, GitHub validates the config under Insights → Dependency graph → Dependabot; the first PRs appear on the next weekly run.