Repository navigation
dependabot: group Cargo minor updates, split cross-letter families, include indirect deps - #40232
Conversation
antiguru
changed the title
| # These releases pull in quick-xml 0.42 next to the quick-xml the rest of | ||
| # the graph uses, which cargo deny rejects as a duplicate. | ||
| - dependency-name: opendal* | ||
| versions: [">=0.59.5"] | ||
| - dependency-name: reqsign-aws-core | ||
| versions: [">=3.2"] | ||
| - dependency-name: reqsign-aws-v4 | ||
| versions: [">=3.3.1"] | ||
| - dependency-name: reqsign-google | ||
| versions: [">=3.2"] |
There was a problem hiding this comment.
I think we shouldn't prevent these updates just for a cargo deny rejection.
There was a problem hiding this comment.
Removed the hdrhistogram, opendal and reqsign ignores in fee0451; only idna_adapter stays. (Posted by Claude Code)
fee0451 to
7da630a
Compare
antiguru
changed the title
bosconi
left a comment
bosconi
left a comment
There was a problem hiding this comment.
Two group boundaries need fixing, and the comment block should cover 0.x bumps. Details inline.
| proto: | ||
| applies-to: version-updates | ||
| update-types: [minor, patch] | ||
| patterns: ["prost*", "tonic*"] |
There was a problem hiding this comment.
telemetry and proto need to be one group.
opentelemetry-otlp depends on tonic and prost (Cargo.lock), all 0.x. An otlp release that moves to a new tonic splits across the two groups, and each PR alone fails multiple-versions = "deny". console-subscriber has the same dependencies (Cargo.lock) and lands in simple1 via c*. Suggest ["tracing*", "opentelemetry*", "prost*", "tonic*", "console-subscriber"].
There was a problem hiding this comment.
Merged into one telemetry-grpc group with console-subscriber in 4872e7b. (Posted by Claude Code)
| arrow: | ||
| applies-to: version-updates | ||
| update-types: [minor, patch] | ||
| patterns: ["arrow*", "parquet", "iceberg*", "object_store"] |
There was a problem hiding this comment.
Add duckdb here. It depends on arrow (Cargo.lock), and #40266 already fails cargo deny on duplicate arrow-* crates (lint log). Under this config it joins simple1 and blocks all of a-m. object_store matches nothing in Cargo.lock.
There was a problem hiding this comment.
Added duckdb (and libduckdb-sys, which moves with it) to arrow and dropped object_store in 4872e7b. (Posted by Claude Code)
There was a problem hiding this comment.
Follow-up in bb2e7f4: duckdb and libduckdb-sys now have their own group instead of joining arrow. A DuckDB release changes the libduckdb version that bin/lint-versions requires ci/builder/Dockerfile to install, and Dependabot can't edit the Dockerfile, so every such PR is red until someone pushes the download URL and checksums. #40266 (DuckDB 2.0) is that case. Inside arrow it would block arrow, parquet and iceberg each time. duckdb 1.10506 requires arrow ^58, so minor and patch arrow updates don't need duckdb to move along, and arrow majors aren't grouped. Patch releases of the duckdb crates keep the DuckDB version and pass on their own. (Posted by Claude Code)
| applies-to: version-updates | ||
| update-types: | ||
| - patch | ||
| update-types: [minor, patch] |
There was a problem hiding this comment.
Dependabot treats 0.y -> 0.(y+1) as minor, so Cargo-breaking 0.x bumps land here and in simple2. Please say so in the comment at lines 30-36, with the triage path for a red group: @dependabot ignore <crate> minor version, or a fix commit on the group branch.
There was a problem hiding this comment.
Added a NOTE to the group comment covering 0.x minor bumps and the two triage paths, in 4872e7b. (Posted by Claude Code)
7b37202 to
4872e7b
Compare
Replace the alphabetical patch-only groups for the root Cargo workspace with groups of crates that must move together, so shared transitive dependencies stay unified and cargo deny's duplicate check passes. Minor and patch updates are grouped, major updates stay individual. Also allow lockfile-only updates of indirect dependencies, and ignore the releases that would add a duplicate crate or switch idna to the ICU4X backend. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…er families Only families whose crates start with different letters need their own group. Families that share a first letter (aws-*, serde*, windows*) stay together in the alphabetical groups, and splitting the rest in two keeps one broken update from blocking most of the graph. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
opentelemetry-otlp and console-subscriber depend on tonic and prost, and duckdb depends on arrow, so a release that moves them must land in one PR or cargo deny rejects the duplicate crates. Drop object_store, which nothing depends on. Note that Dependabot counts 0.x bumps as minor and how to triage a red group PR. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
4872e7b to
11f90e5
Compare
A DuckDB release changes the libduckdb version that bin/lint-versions requires ci/builder/Dockerfile to install, and Dependabot cannot edit the Dockerfile. In the arrow group every DuckDB release would block arrow, parquet and iceberg updates until someone pushed the Dockerfile change. duckdb 1.10506 requires arrow ^58, so minor and patch arrow updates do not need duckdb to move with them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
def-
left a comment
def-
left a comment
There was a problem hiding this comment.
Seems reasonable, let's see if this causes less churn.
|
Thanks for the reviews! |
Groups minor as well as patch updates for the root Cargo workspace. Patch-only groups let minor updates arrive one crate at a time, which breaks
cargo denywhenever crates sharing transitive dependencies move separately, as aws-config did in #40172. Families whose crates start with different letters get their own groups: the async stack, telemetry with tonic and prost (whichopentelemetry-otlpandconsole-subscriberdepend on), and arrow.duckdbandlibduckdb-sysget a group of their own, because a DuckDB release also needs the libduckdb download inci/builder/Dockerfilechanged by hand. Everything else keeps the existing alphabetical split, which already keeps same-letter families likeaws-*together. Major updates stay individual. Dependabot counts 0.x bumps as minor, so the config comment says how to handle a red group PR.It also enables lockfile-only updates of indirect dependencies. The stack below catches the lockfile up first, so the first run stays small. It ignores
idna_adapter1.2, which would switchidnato ICU4X.🤖 Generated with Claude Code