mirror of
https://github.com/element-hq/synapse.git
synced 2026-05-11 06:16:57 +00:00
Olivier 'reivilibre
c376cdd2ee
See: - https://github.com/element-hq/synapse/pull/19742 - https://github.com/element-hq/synapse/pull/19686 (etc) Documentation https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#versioning-strategy-- We were considering `lockfile-only` but it sounds like `increase-if-necessary` would increase the upper bound for us, if we had one. Let's try it. --------- Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org>
94 lines
3.1 KiB
YAML
94 lines
3.1 KiB
YAML
version: 2
|
|
# As dependabot is currently only run on a weekly basis, we raise the
|
|
# open-pull-requests-limit to 10 (from the default of 5) to better ensure we
|
|
# don't continuously grow a backlog of updates.
|
|
updates:
|
|
- # "pip" is the correct setting for poetry, per https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem
|
|
package-ecosystem: "pip"
|
|
directory: "/"
|
|
open-pull-requests-limit: 10
|
|
versioning-strategy: "increase-if-necessary"
|
|
schedule:
|
|
interval: "weekly"
|
|
# Group patch updates to packages together into a single PR, as they rarely
|
|
# if ever contain breaking changes that need to be reviewed separately.
|
|
#
|
|
# Less PRs means a streamlined review process.
|
|
#
|
|
# Python packages follow semantic versioning, and tend to only introduce
|
|
# breaking changes in major version bumps. Thus, we'll group minor and patch
|
|
# versions together.
|
|
groups:
|
|
minor-and-patches:
|
|
applies-to: version-updates
|
|
patterns:
|
|
- "*"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
# Prevent pulling packages that were recently updated to help mitigate
|
|
# supply chain attacks. 14 days was taken from the recommendation at
|
|
# https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns
|
|
# where the author noted that 9/10 attacks would have been mitigated by a
|
|
# two week cooldown.
|
|
#
|
|
# The cooldown only applies to general updates; security updates will still
|
|
# be pulled in as soon as possible.
|
|
cooldown:
|
|
default-days: 14
|
|
|
|
- package-ecosystem: "docker"
|
|
directory: "/docker"
|
|
open-pull-requests-limit: 10
|
|
schedule:
|
|
interval: "weekly"
|
|
# For container versions, breaking changes are also typically only introduced in major
|
|
# package bumps.
|
|
groups:
|
|
minor-and-patches:
|
|
applies-to: version-updates
|
|
patterns:
|
|
- "*"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
cooldown:
|
|
default-days: 14
|
|
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
open-pull-requests-limit: 10
|
|
schedule:
|
|
interval: "weekly"
|
|
# Similarly for GitHub Actions, breaking changes are typically only introduced in major
|
|
# package bumps.
|
|
groups:
|
|
minor-and-patches:
|
|
applies-to: version-updates
|
|
patterns:
|
|
- "*"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
cooldown:
|
|
default-days: 14
|
|
|
|
- package-ecosystem: "cargo"
|
|
directory: "/"
|
|
open-pull-requests-limit: 10
|
|
versioning-strategy: "lockfile-only"
|
|
schedule:
|
|
interval: "weekly"
|
|
# The Rust ecosystem is special in that breaking changes are often introduced
|
|
# in minor version bumps, as packages typically stay pre-1.0 for a long time.
|
|
# Thus we specifically keep minor version bumps separate in their own PRs.
|
|
groups:
|
|
patches:
|
|
applies-to: version-updates
|
|
patterns:
|
|
- "*"
|
|
update-types:
|
|
- "patch"
|
|
cooldown:
|
|
default-days: 14
|