This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 00679b8127a Group Dependabot security updates and keep v3-3-test
covered (#70556)
00679b8127a is described below
commit 00679b8127ac6a3dbe85182ab3336d74dce5239e
Author: Jarek Potiuk <[email protected]>
AuthorDate: Tue Jul 28 14:02:07 2026 +0200
Group Dependabot security updates and keep v3-3-test covered (#70556)
* Group Dependabot security updates
Dependabot groups only apply to security updates when they declare
`applies-to: security-updates`; without it a group covers version updates
only. Every group in our config relied on that default, so alert-driven
bumps bypassed grouping entirely and opened one PR each - axios in edge3
(#70145), mermaid (#69132, #69137), gitpython (#70428), zeep (#68780),
@hey-api/openapi-ts (#69265) and the two /go-sdk Go bumps (#70226, #69214).
Add a `security-updates` group to every entry that targets the default
branch. Entries carrying `target-branch: v3-3-test` are deliberately left
alone: Dependabot raises security updates against the default branch only,
so a security group there would never match. Comments note this so it does
not look like an oversight.
The three existing `*-major-version-updates` groups were already
`applies-to: security-updates` but restricted to `update-types: [major]`,
so minor and patch security fixes fell through ungrouped. They are widened
to cover all security updates and renamed to `*-security-updates` to match
what they actually do.
Also adds a `gomod` entry for /go-sdk, which had no configuration at all -
its Go security bumps were arriving individually because Dependabot raises
security updates for ecosystems with no entry, but can only group them when
one exists.
Generated-by: Claude Opus 5 (1M context)
* Mirror remaining dependency directories onto v3-3-test
Dependabot raises security updates against the default branch only, so a fix
that lands on main does not reach a maintenance branch by itself.
Cherry-picking
one over is unreliable: these commits carry lock file diffs, and main's lock
files have long diverged from v3-3-test's, so the pick conflicts more often
than
not.
Letting Dependabot maintain the branch directly avoids that entirely - it
resolves the dependency and regenerates the lock file on v3-3-test itself.
Six
directories were tracked on main but not on the maintenance branch, so a
fixed
version had no way of reaching it:
- npm: edge3 www, fab www, /registry, react plugin template
- uv: /dev/breeze
- gomod: /go-sdk
They now have `target-branch: v3-3-test` entries following the policy the
branch
already uses for core-ui and auth-ui: minor and patch only, majors ignored.
A
fix that needs a major bump still has to be backported by hand.
`dev/update_github_branch_config.py` generates the same six entries, so
cutting
the next release branch does not silently reintroduce the gap.
Generated-by: Claude Opus 5 (1M context)
---
.github/dependabot.yml | 173 +++++++++++++++++++++++++++++++++++--
dev/update_github_branch_config.py | 117 +++++++++++++++++++++++++
2 files changed, 281 insertions(+), 9 deletions(-)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f0337bb052b..be600ed4a09 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -15,6 +15,11 @@
# specific language governing permissions and limitations
# under the License
---
+# NOTE: a group applies to version updates unless it declares `applies-to:
security-updates`.
+# Every entry below that targets the default branch therefore carries a
matching
+# `*-security-updates` group, so alert-driven bumps arrive batched instead of
one PR per
+# dependency. Entries using `target-branch` deliberately have no such group -
Dependabot raises
+# security updates against the default branch only, so it would never match
anything there.
version: 2
updates:
- package-ecosystem: "github-actions"
@@ -28,6 +33,10 @@ updates:
github-actions-updates:
patterns:
- "*"
+ github-actions-security-updates:
+ applies-to: security-updates
+ patterns:
+ - "*"
- package-ecosystem: "github-actions"
directory: "/"
@@ -61,6 +70,10 @@ updates:
pip-dependency-updates:
patterns:
- "*"
+ pip-security-updates:
+ applies-to: security-updates
+ patterns:
+ - "*"
- package-ecosystem: npm
cooldown:
@@ -96,12 +109,10 @@ updates:
update-types:
- "minor"
- "patch"
- core-ui-major-version-updates:
+ core-ui-security-updates:
patterns:
- "*"
applies-to: security-updates
- update-types:
- - "major"
- package-ecosystem: npm
cooldown:
@@ -117,12 +128,10 @@ updates:
update-types:
- "minor"
- "patch"
- auth-ui-major-version-updates:
+ auth-ui-security-updates:
patterns:
- "*"
applies-to: security-updates
- update-types:
- - "major"
- package-ecosystem: npm
cooldown:
@@ -138,6 +147,10 @@ updates:
update-types:
- "minor"
- "patch"
+ ui-plugin-template-security-updates:
+ patterns:
+ - "*"
+ applies-to: security-updates
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major"]
@@ -153,6 +166,10 @@ updates:
edge-ui-package-updates:
patterns:
- "*"
+ edge-ui-security-updates:
+ patterns:
+ - "*"
+ applies-to: security-updates
- package-ecosystem: npm
cooldown:
@@ -165,6 +182,10 @@ updates:
fab-ui-package-updates:
patterns:
- "*"
+ fab-ui-security-updates:
+ patterns:
+ - "*"
+ applies-to: security-updates
- package-ecosystem: npm
cooldown:
@@ -180,12 +201,10 @@ updates:
update-types:
- "minor"
- "patch"
- registry-major-version-updates:
+ registry-security-updates:
patterns:
- "*"
applies-to: security-updates
- update-types:
- - "major"
# Repeat dependency updates on v3-3-test branch as well
- package-ecosystem: pip
@@ -247,6 +266,123 @@ updates:
- dependency-name: "*"
update-types: ["version-update:semver-major"]
+ # The remaining directories are mirrored onto v3-3-test as well. Dependabot
raises security
+ # updates against the default branch only, so a fixed version reaches the
maintenance branch
+ # through its own version updates - Dependabot resolves and regenerates the
lock file on that
+ # branch, which a cherry-picked lock file diff from main cannot do. Majors
stay ignored, so a
+ # fix that needs a major bump still has to be backported by hand.
+ - package-ecosystem: npm
+ cooldown:
+ default-days: 4
+ directories:
+ - /providers/edge3/src/airflow/providers/edge3/plugins/www
+ schedule:
+ interval: "weekly"
+ target-branch: v3-3-test
+ groups:
+ 3-3-edge-ui-package-updates:
+ patterns:
+ - "*"
+ update-types:
+ - "minor"
+ - "patch"
+ ignore:
+ - dependency-name: "*"
+ update-types: ["version-update:semver-major"]
+
+ - package-ecosystem: npm
+ cooldown:
+ default-days: 4
+ directories:
+ - /providers/fab/src/airflow/providers/fab/www
+ schedule:
+ interval: daily
+ target-branch: v3-3-test
+ groups:
+ 3-3-fab-ui-package-updates:
+ patterns:
+ - "*"
+ update-types:
+ - "minor"
+ - "patch"
+ ignore:
+ - dependency-name: "*"
+ update-types: ["version-update:semver-major"]
+
+ - package-ecosystem: npm
+ cooldown:
+ default-days: 4
+ directories:
+ - /registry
+ schedule:
+ interval: "weekly"
+ target-branch: v3-3-test
+ groups:
+ 3-3-registry-package-updates:
+ patterns:
+ - "*"
+ update-types:
+ - "minor"
+ - "patch"
+ ignore:
+ - dependency-name: "*"
+ update-types: ["version-update:semver-major"]
+
+ - package-ecosystem: npm
+ cooldown:
+ default-days: 4
+ directories:
+ - /dev/react-plugin-tools/react_plugin_template
+ schedule:
+ interval: "weekly"
+ target-branch: v3-3-test
+ groups:
+ 3-3-ui-plugin-template-package-updates:
+ patterns:
+ - "*"
+ update-types:
+ - "minor"
+ - "patch"
+ ignore:
+ - dependency-name: "*"
+ update-types: ["version-update:semver-major"]
+
+ - package-ecosystem: "uv"
+ cooldown:
+ default-days: 4
+ directory: "/dev/breeze"
+ schedule:
+ interval: "weekly"
+ target-branch: v3-3-test
+ groups:
+ 3-3-uv-dependency-updates:
+ patterns:
+ - "*"
+ update-types:
+ - "minor"
+ - "patch"
+ ignore:
+ - dependency-name: "*"
+ update-types: ["version-update:semver-major"]
+
+ - package-ecosystem: "gomod"
+ cooldown:
+ default-days: 4
+ directory: "/go-sdk"
+ schedule:
+ interval: "weekly"
+ target-branch: v3-3-test
+ groups:
+ 3-3-go-sdk-dependency-updates:
+ patterns:
+ - "*"
+ update-types:
+ - "minor"
+ - "patch"
+ ignore:
+ - dependency-name: "*"
+ update-types: ["version-update:semver-major"]
+
- package-ecosystem: "uv"
cooldown:
default-days: 4
@@ -257,3 +393,22 @@ updates:
uv-dependency-updates:
patterns:
- "*"
+ uv-security-updates:
+ patterns:
+ - "*"
+ applies-to: security-updates
+
+ - package-ecosystem: "gomod"
+ cooldown:
+ default-days: 4
+ directory: "/go-sdk"
+ schedule:
+ interval: "weekly"
+ groups:
+ go-sdk-dependency-updates:
+ patterns:
+ - "*"
+ go-sdk-security-updates:
+ patterns:
+ - "*"
+ applies-to: security-updates
diff --git a/dev/update_github_branch_config.py
b/dev/update_github_branch_config.py
index 84045c07f40..1b5793e2e7e 100755
--- a/dev/update_github_branch_config.py
+++ b/dev/update_github_branch_config.py
@@ -156,6 +156,123 @@ def update_dependabot(new_branch: str, prev_branch: str,
new_dash: str) -> None:
- dependency-name: "*"
update-types: ["version-update:semver-major"]
+ # The remaining directories are mirrored onto {new_branch} as well.
Dependabot raises security
+ # updates against the default branch only, so a fixed version reaches the
maintenance branch
+ # through its own version updates - Dependabot resolves and regenerates the
lock file on that
+ # branch, which a cherry-picked lock file diff from main cannot do. Majors
stay ignored, so a
+ # fix that needs a major bump still has to be backported by hand.
+ - package-ecosystem: npm
+ cooldown:
+ default-days: 4
+ directories:
+ - /providers/edge3/src/airflow/providers/edge3/plugins/www
+ schedule:
+ interval: "weekly"
+ target-branch: {new_branch}
+ groups:
+ {new_dash}-edge-ui-package-updates:
+ patterns:
+ - "*"
+ update-types:
+ - "minor"
+ - "patch"
+ ignore:
+ - dependency-name: "*"
+ update-types: ["version-update:semver-major"]
+
+ - package-ecosystem: npm
+ cooldown:
+ default-days: 4
+ directories:
+ - /providers/fab/src/airflow/providers/fab/www
+ schedule:
+ interval: daily
+ target-branch: {new_branch}
+ groups:
+ {new_dash}-fab-ui-package-updates:
+ patterns:
+ - "*"
+ update-types:
+ - "minor"
+ - "patch"
+ ignore:
+ - dependency-name: "*"
+ update-types: ["version-update:semver-major"]
+
+ - package-ecosystem: npm
+ cooldown:
+ default-days: 4
+ directories:
+ - /registry
+ schedule:
+ interval: "weekly"
+ target-branch: {new_branch}
+ groups:
+ {new_dash}-registry-package-updates:
+ patterns:
+ - "*"
+ update-types:
+ - "minor"
+ - "patch"
+ ignore:
+ - dependency-name: "*"
+ update-types: ["version-update:semver-major"]
+
+ - package-ecosystem: npm
+ cooldown:
+ default-days: 4
+ directories:
+ - /dev/react-plugin-tools/react_plugin_template
+ schedule:
+ interval: "weekly"
+ target-branch: {new_branch}
+ groups:
+ {new_dash}-ui-plugin-template-package-updates:
+ patterns:
+ - "*"
+ update-types:
+ - "minor"
+ - "patch"
+ ignore:
+ - dependency-name: "*"
+ update-types: ["version-update:semver-major"]
+
+ - package-ecosystem: "uv"
+ cooldown:
+ default-days: 4
+ directory: "/dev/breeze"
+ schedule:
+ interval: "weekly"
+ target-branch: {new_branch}
+ groups:
+ {new_dash}-uv-dependency-updates:
+ patterns:
+ - "*"
+ update-types:
+ - "minor"
+ - "patch"
+ ignore:
+ - dependency-name: "*"
+ update-types: ["version-update:semver-major"]
+
+ - package-ecosystem: "gomod"
+ cooldown:
+ default-days: 4
+ directory: "/go-sdk"
+ schedule:
+ interval: "weekly"
+ target-branch: {new_branch}
+ groups:
+ {new_dash}-go-sdk-dependency-updates:
+ patterns:
+ - "*"
+ update-types:
+ - "minor"
+ - "patch"
+ ignore:
+ - dependency-name: "*"
+ update-types: ["version-update:semver-major"]
+
"""
prev_comment = f" # Repeat dependency updates on {prev_branch} branch as
well"
content = content.replace(prev_comment, pip_npm_block + prev_comment, 1)
