balena-cli 12.2.0

[pranasziaukas]

Created with brew bump-formula-pr.

[SMillerDev]

The last update was 2 days ago, either we need to postpone this PR (and write an audit to enforce the rule) or remove the comment. @Homebrew/core opinions?

[pranasziaukas]

To make things more nuanced, please note that updates ain't equal. Following semantic versioning, is it worth prioritizing major or minor releases compared to patches?
Also, is it ethical to withhold releases given that they might be fixing security vulnerabilities?

[SMillerDev]

Also, is it ethical to withhold releases given that they might be fixing security vulnerabilities?

With a release a day you're using so much CI resources that you're probably regularly delaying security updates to things like Go and OpenSSL. Any CI time can only be used once and there's almost always a queue.

[MikeMcQuaid]

Also, is it ethical to withhold releases given that they might be fixing security vulnerabilities?

Does this release fix security vulnerabilities?

[pranasziaukas]

Cool. Please note that I'm not trying to force any opinion rather than just to add to the potential discussion.

[pranasziaukas]

Does this release fix security vulnerabilities?

I don't know because I'm not a developer of balena CLI.

[pranasziaukas]

Overall, this formula has been updated 11 times this month already so it's obvious that the current limits are disregarded.

Feel free to decide on the throttling mechanism that works or remove the comment.

[alebcay]

I usually group up some fast-moving formulae like this and do one big push of them when CI's quiet (for me, usually like midnight-2am local time - late enough to dodge US PRs and early enough to dodge most Europe PRs).

It might be easier changing the rule to "bump only on multiples of 10" or something like that. That way contributors don't have to dig through Git history to check. I think that's also probably easier/faster to audit than checking the last time of modification.

[MikeMcQuaid]

Does this release fix security vulnerabilities?

I don't know because I'm not a developer of balena CLI.

I'm not sure it was relevant to bring them up, then.

It might be easier changing the rule to "bump only on multiples of 10" or something like that. That way contributors don't have to dig through Git history to check. I think that's also probably easier/faster to audit than checking the last time of modification.

Yes, we already have a mechanism for this:
https://github.com/Homebrew/brew/blob/a1ba14255f789e4b20f796ed9ae23da3d47e8151/Library/Homebrew/dev-cmd/audit.rb#L553-L558

We should do the same thing here and remove the comment (and any on any similar formulae).