mirror of
https://github.com/element-hq/synapse.git
synced 2026-11-04 13:28:04 +00:00
96 lines
3.1 KiB
YAML
96 lines
3.1 KiB
YAML
# Configure general package update PRs filed by dependabot.
|
|
# Security update PRs are generally unaffected by these settings.
|
|
version: 2
|
|
|
|
updates:
|
|
- # "pip" is the correct setting for poetry, per
|
|
# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem
|
|
package-ecosystem: "pip"
|
|
directory: "/"
|
|
# Only bump the minimum and maximum versions of dependencies in our
|
|
# lockfile. The maximum version in `pyproject.toml` may be bumped, but the
|
|
# minimum may not be.
|
|
#
|
|
# We want to avoid bumping the minimum version in `pyproject.toml` unless
|
|
# necessary, as it requires our supported Linux distributions to have
|
|
# those versions in their repos first.
|
|
versioning-strategy: "increase-if-necessary"
|
|
# Group together all updates for this ecosystem into a single, big PR.
|
|
#
|
|
# Doing this prevents us from needing to review a PR per dependency upgrade
|
|
# (which can become burdensome).
|
|
#
|
|
# Splitting up each ecosystem into their own PR (rather than putting ALL
|
|
# upgrades into a single PR) allows us to more quicker determine the culprit
|
|
# when CI fails.
|
|
groups:
|
|
all-python-dependencies:
|
|
applies-to: version-updates
|
|
patterns:
|
|
# Update all non-transitive dependencies.
|
|
- "*"
|
|
open-pull-requests-limit: 1
|
|
# Prevent pulling packages that were recently updated to help mitigate
|
|
# supply chain attacks. 14 days was taken from the recommendation at
|
|
# https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns
|
|
# where the author noted that 9/10 attacks would have been mitigated by a
|
|
# two week cooldown.
|
|
#
|
|
# The cooldown only applies to general updates; security updates will still
|
|
# be pulled in as soon as possible.
|
|
cooldown:
|
|
default-days: 14
|
|
schedule:
|
|
interval: "monthly"
|
|
time: "08:00"
|
|
timezone: "Europe/London"
|
|
|
|
- package-ecosystem: "cargo"
|
|
directory: "/"
|
|
open-pull-requests-limit: 1
|
|
groups:
|
|
all-rust-dependencies:
|
|
applies-to: version-updates
|
|
patterns:
|
|
- "*"
|
|
schedule:
|
|
interval: "monthly"
|
|
time: "08:00"
|
|
timezone: "Europe/London"
|
|
cooldown:
|
|
default-days: 14
|
|
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
open-pull-requests-limit: 1
|
|
groups:
|
|
all-github-actions:
|
|
applies-to: version-updates
|
|
patterns:
|
|
- "*"
|
|
schedule:
|
|
interval: "monthly"
|
|
time: "08:00"
|
|
timezone: "Europe/London"
|
|
cooldown:
|
|
default-days: 14
|
|
|
|
- package-ecosystem: "gomod"
|
|
directory: "/complement"
|
|
open-pull-requests-limit: 1
|
|
groups:
|
|
all-go-dependencies:
|
|
applies-to: version-updates
|
|
patterns:
|
|
- "*"
|
|
schedule:
|
|
interval: "monthly"
|
|
time: "08:00"
|
|
timezone: "Europe/London"
|
|
cooldown:
|
|
default-days: 14
|
|
|
|
# Note: "docker" is purposefully excluded from this list.
|
|
#
|
|
# Our docker containers should be kept up-to-date using container scanning
|
|
# technology instead of dependabot. |