search

openwallet-foundation / owl-akrida

Apache License 2.0
3 stars 16 forks source link

chore: updating dependabot to support github-actions, python, TS and docker packages #51

Closed rajpalc7 closed 6 months ago

loneil commented 7 months ago

I'm not sure how dependencies are desired to be managed for this repo, but for (one) example here this 

    "@aries-framework/anoncreds": "^0.4.0",
    "@aries-framework/askar": "^0.4.0",
    "@aries-framework/core": "^0.4.0",
    "@aries-framework/indy-sdk": "^0.4.0",
    "@aries-framework/node": "^0.4.0",
    "@aries-framework/react-native": "^0.4.0",

would trigger 6(?) dependabot pull requests, but none of those would be auto-mergeable as switching from AFJ 0.4.x to Credo 0.5.x is going to need to be a considered framework change (for example: https://github.com/hyperledger/aries-akrida/issues/50), not just a chore for keeping libraries up to date.

So is those 6 PRs just noise in that case? Not that I have a better idea :) but just food for thought on an example for these dependabot settings.

dbluhm commented 7 months ago

Dependabot is pretty eager to open PRs updating a dependency to a new major version. Keeps on trying to get me to update to Pydantic v2 in several repos... In that case, I manually told dependabot to ignore that dependency. In retrospect, I'm not sure if that means it won't do patch release updates either or what.

WadeBarnes commented 7 months ago

So is those 6 PRs just noise in that case?

In this case I would see the PRs from dependabot as an explicit indication there are updates available for those packages. What you do with that information is project specific with a large dose of maintainer preference.