plusplusjiajia opened a new pull request, #756:
URL: https://github.com/apache/paimon-rust/pull/756
### Purpose
Dependabot's default strategy only opens a pull request when a requirement
has to change. A version the manifests already accept is never proposed, so the
lockfile drifts until someone refreshes it by hand — which is how this was
noticed.
Two of those are sitting there now, both inside the ranges the manifests
declare:
- `arrow` has been at 58.3.0 since the lockfile was committed in #558
(July), while 58.4.0 — a maintenance release carrying backported cargo audit
fixes — has been out.
- `opendal` likewise at 0.58.0 against 0.58.2.
Neither needs a manifest edit, so neither was ever offered.
### Brief change log
- `versioning-strategy: lockfile-only` on the cargo entry, so a version
already inside a declared range is proposed too.
- `open-pull-requests-limit: 20`. lockfile-only reaches transitive
dependencies as well, which is more volume than the default of five can hold
without crowding out the requirement bumps Dependabot opens today.
- A group for `arrow*` and `parquet`. Those crates share a version and
have to move together; proposed separately, each pull request fails to resolve
against the others.
Patch updates are deliberately not excluded: `opendal` above is a
patch-level drift, so ignoring them would leave half of what this is meant to
catch.
This is a policy choice rather than a fix — if the current cadence is
deliberate, say so and I will close it.
### Tests
`.github/dependabot.yml` parses. Dependabot validates the file itself on
push and reports errors on the repository's Dependabot page.
### API and Format
No API change, no format change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
