search

shell-pool / shpool

Think tmux, then aim... lower
Apache License 2.0
1.17k stars 20 forks source link

chore: bump lazy_static from 1.4.0 to 1.5.0 #80

Closed dependabot[bot] closed 4 months ago

dependabot[bot] commented 4 months ago

Bumps lazy_static from 1.4.0 to 1.5.0.

Commits


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
ethanpailes commented 4 months ago

I'm worried that being really agressive about dep upgrades will add a bunch of toil when go to import the crate in the internal google monorepo, also I'm worried about MSRV. Lots of crates don't do a good job of keeping an old MSRV and we need to keep ours from advancing for a while so that distros like debian can start being able to build shpool without resorting to rustup.

Aetf commented 4 months ago

Agreed. The current cadence is checking weekly, with maximum 5 PRs open in total per package ecosystem. We can tweak the frequency to whatever we like, and maybe skip patch version updates? How often do we currently handle dependency updates?

As for MSRV, I thought our CI should catch any regression (which btw reads rust-toolchain.toml for tests). So as long as it's all green in the PR, we should be all good.

ethanpailes commented 4 months ago

Yeah that's a good point about CI, and we probably should be making sure our deps are up to date for security reasons. Hopefully a lot of the minor version updates will not require much toil to update.

ethanpailes commented 4 months ago

I made https://github.com/shell-pool/shpool/pull/81 so we can confirm toolchain version in CI just to be sure.