Infra: Create more targeted groups for gradle and group all the action upgrades #1542
Conversation
kapybro
bot
added
status/triage
|
@Haarolean Could you check this out? |
| # In general, our Netty references are temporary overrides, usually applied to address transitive Spring vulnerabilities, and should be configured with caution | ||
| # In general, having conflicting Netty versions in the classpath is not recommended | ||
| - dependency-name: "io.netty:*" | ||
| # We will handle major upgrades manually |
There was a problem hiding this comment.
i don't mind having PRs for these if they don't hog up the total amount of open PRs. Otherwise nobody will ever check if there's a new spring boot out
There was a problem hiding this comment.
The challenge with Dependabot is that you can enable either major or minor upgrades, but not both at the same time. If we enable major upgrades, only those will appear, and the smaller, more manageable minor upgrades will no longer be shown.
In the case of Spring Boot, we will see Spring Boot 4.x immediately but no minor versions like 3.5.8. So while we wait to allocate capacity for the 4.x bump, we will need to manage minor versions manually
| exclude-patterns: | ||
| - "org.springframework.boot:*" | ||
| - "io.spring.dependency-management" | ||
| - "io.modelcontextprotocol.sdk:mcp-spring-webflux" |
There was a problem hiding this comment.
why is this suddently a spring boot dependency?
There was a problem hiding this comment.
It is not, but I deducted from the name that it is probably a good idea to test these together as mcp-spring-webflux depends on Spring Webflux
There was a problem hiding this comment.
Do you think it should be separate?
.github/dependabot.yml
Outdated
| - "org.testcontainers:*" | ||
| - "org.junit.jupiter:*" | ||
| - "org.assertj:*" | ||
| - "com.gorylenko.gradle-git-properties" |
There was a problem hiding this comment.
"com.gorylenko.gradle-git-properties" that package is for adding git meta info into the build, not testing
2 participants
What changes did you make?
Updated the Dependabot configuration to define more targeted groups.
The intent is to increase the number of Dependabot pull requests that successfully merge into
main, as the current grouping is too ambitious and frequently breaks the build (see #1520) causing us to simply ignore the updates and not get the main benefit of DependabotThe action group was created because it’s generally safer to bundle these updates together. Depending on how things progress, we may need to apply a similar adjustment to it as well.
How Has This Been Tested? (put an "x" (case-sensitive!) next to an item)
I tested the groups in my fork: https://github.com/yeikel/kafka-ui/pulls
Checklist (put an "x" (case-sensitive!) next to all the items, otherwise the build will fail)
A picture of a cute animal (not mandatory but encouraged)