1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
version: 2
updates:
# Rust dependencies (workspace). Grouped to keep PR volume low:
# minor-and-patch -> one auto-mergeable PR
# major-updates -> one PR for review (majors usually need code changes)
- package-ecosystem: cargo
directory: "/"
# NOTE: do NOT add `versioning-strategy` here. For the cargo ecosystem
# dependabot accepts only `lockfile-only` or `auto` -- `increase` and
# `increase-if-necessary` are rejected outright and invalidate this whole
# file, which disables dependabot for the repository -- which is what PR
# #150 did, until this change reverted it. So the #140 shape cannot be
# prevented by configuration at all:
# - `auto` (this default) means "widen for libraries". A Cargo caret
# requirement cannot be widened to admit a new major, so dependabot
# degrades to a lockfile-only update and ships a Cargo.lock that
# Cargo.toml forbids -- exactly #129.
# - `lockfile-only` would avoid that, but by silently DROPPING every
# update that needs a manifest edit, which would quietly kill the
# `major-updates` group below and is a worse trade: a silent gap in
# place of a loud, catchable failure.
# It is caught instead, not prevented: the `cargo metadata --locked` step
# in ci.yml's Check job fails any PR whose lockfile disagrees with the
# manifests. On such a dependabot PR, update Cargo.toml in the same PR.
schedule:
interval: monthly
open-pull-requests-limit: 5
groups:
minor-and-patch:
update-types:
major-updates:
update-types:
ignore:
- dependency-name: "jsonwebtoken"
update-types:
- package-ecosystem: cargo
directory: "/integration_tests"
# NOTE: do NOT add `versioning-strategy` here. For the cargo ecosystem
# dependabot accepts only `lockfile-only` or `auto` -- `increase` and
# `increase-if-necessary` are rejected outright and invalidate this whole
# file, which disables dependabot for the repository -- which is what PR
# #150 did, until this change reverted it. So the #140 shape cannot be
# prevented by configuration at all:
# - `auto` (this default) means "widen for libraries". A Cargo caret
# requirement cannot be widened to admit a new major, so dependabot
# degrades to a lockfile-only update and ships a Cargo.lock that
# Cargo.toml forbids -- exactly #129.
# - `lockfile-only` would avoid that, but by silently DROPPING every
# update that needs a manifest edit, which would quietly kill the
# `major-updates` group below and is a worse trade: a silent gap in
# place of a loud, catchable failure.
# It is caught instead, not prevented: the `cargo metadata --locked` step
# in ci.yml's `integration` job -- NOT the Check job, which guards only the
# root lock -- fails any PR whose `integration_tests/Cargo.lock` disagrees
# with the manifests. On such a dependabot PR, update Cargo.toml in the
# same PR.
schedule:
interval: monthly
open-pull-requests-limit: 3
groups:
minor-and-patch:
update-types:
major-updates:
update-types:
# All GitHub Actions bumps arrive as ONE grouped PR (SHA + comment updates).
- package-ecosystem: github-actions
directory: "/"
schedule:
interval: monthly
open-pull-requests-limit: 3
groups:
actions:
patterns:
- package-ecosystem: docker
directory: /
schedule:
interval: monthly
open-pull-requests-limit: 5
groups:
docker:
patterns: