This is an automated email from the ASF dual-hosted git repository.
vincbeck pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 41434c2f3fd Stop Dependabot from raising provider PRs on v3-3-test
(#73474)
41434c2f3fd is described below
commit 41434c2f3fde64098b1d3c37e02ba5d55f338484
Author: Vincent <[email protected]>
AuthorDate: Mon Sep 21 14:24:07 2026 -0400
Stop Dependabot from raising provider PRs on v3-3-test (#73474)
Providers are released from main, so dependency bumps to provider
directories on a maintenance branch never reach users. The resulting PRs
are review noise on a branch whose review capacity is reserved for
backports.
---
.github/dependabot.yml | 52 +++++++++-----------------------------------------
1 file changed, 9 insertions(+), 43 deletions(-)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b297d4d0a7e..43342674265 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -308,49 +308,15 @@ updates:
- dependency-name: "*"
update-types: ["version-update:semver-major"]
- # The remaining directories are mirrored onto v3-3-test as well. Dependabot
raises security
- # updates against the default branch only, so a fixed version reaches the
maintenance branch
- # through its own version updates - Dependabot resolves and regenerates the
lock file on that
- # branch, which a cherry-picked lock file diff from main cannot do. Majors
stay ignored, so a
- # fix that needs a major bump still has to be backported by hand.
- - package-ecosystem: npm
- cooldown:
- default-days: 4
- directories:
- - /providers/edge3/src/airflow/providers/edge3/plugins/www
- schedule:
- interval: "weekly"
- target-branch: v3-3-test
- groups:
- 3-3-edge-ui-package-updates:
- patterns:
- - "*"
- update-types:
- - "minor"
- - "patch"
- ignore:
- - dependency-name: "*"
- update-types: ["version-update:semver-major"]
-
- - package-ecosystem: npm
- cooldown:
- default-days: 4
- directories:
- - /providers/fab/src/airflow/providers/fab/www
- schedule:
- interval: daily
- target-branch: v3-3-test
- groups:
- 3-3-fab-ui-package-updates:
- patterns:
- - "*"
- update-types:
- - "minor"
- - "patch"
- ignore:
- - dependency-name: "*"
- update-types: ["version-update:semver-major"]
-
+ # The remaining non-provider directories are mirrored onto v3-3-test as
well. Dependabot raises
+ # security updates against the default branch only, so a fixed version
reaches the maintenance
+ # branch through its own version updates - Dependabot resolves and
regenerates the lock file on
+ # that branch, which a cherry-picked lock file diff from main cannot do.
Majors stay ignored, so
+ # a fix that needs a major bump still has to be backported by hand.
+ #
+ # Provider directories (providers/*) are deliberately NOT mirrored onto
v3-3-test: providers are
+ # released from main, so their dependencies on a maintenance branch never
ship to users and the
+ # PRs are pure review noise.
- package-ecosystem: npm
cooldown:
default-days: 4
