Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: configure dependabot @W-15450855 #4130

Merged
merged 1 commit into from
Apr 11, 2024
Merged

chore: configure dependabot @W-15450855 #4130

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
16 changes: 16 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
# Please see the documentation for all configuration options:
# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file

version: 2
updates:
- package-ecosystem: "npm" # See documentation for possible values
directory: "/" # Location of package manifests
schedule:
interval: "weekly"
groups:
# Non-major version bumps hopefully shouldn't break anything,
# so let's group them together into a single PR!
theoretically-non-breaking:
update-types:
- "minor"
- "patch"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately there are some "theoretically non-breaking" updates that we currently can't take, namely acorn and tachometer:

lwc/packages/@lwc/template-compiler/package.json

Line 45 in 6c46adb

"//": "Acorn is pinned due to a breaking change in its types in 8.11: https://github.com/acornjs/acorn/issues/1260",

lwc/packages/@lwc/perf-benchmarks/package.json

Line 15 in 6c46adb

"Also note we are pinned to Tachometer 0.5.10 due to a breaking change in 0.6.0.",

(Tachometer may not qualify, because I'm not sure whether Dependabot understands that 0.x.x dependencies are anything-goes when it comes to SemVer.)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK well we can fix acorn separately: #4132