Skip to content

chore(deps): separate major updates and narrow Kubernetes ignores #28

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sunib merged 1 commit into from
Sep 11, 2026
Merged

chore(deps): separate major updates and narrow Kubernetes ignores #28

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 12 additions & 5 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,9 @@
# Grouped, so a week of upstream patch releases is one PR to review and one release-note line — not
# eleven. Every ecosystem in the repo is listed: an ecosystem that is not listed here is one where
# nobody is watching.
# eleven. Major updates stay separate for individual review.
#
# Conventional commits, because release-please reads them: `chore(deps):` keeps routine bumps out of
# the changelog, which is what a consumer of this library wants — they do not care that our linter
# moved. The k8s.io/* floor is DELIBERATELY excluded below; see gateway/kube/go.mod for why.
# moved. The Kubernetes API/client floors are DELIBERATELY excluded below; see gateway/kube/go.mod.
version: 2

updates:
Expand All @@ -15,6 +14,7 @@ updates:
groups:
github-actions:
patterns: ["*"]
update-types: ["minor", "patch"]
commit-message:
prefix: "chore(deps)"

Expand All @@ -27,13 +27,17 @@ updates:
groups:
gomod:
patterns: ["*"]
update-types: ["minor", "patch"]
ignore:
# The k8s.io/* requirement is a SUPPORTED-VERSION FLOOR, not a version to keep current: Go's
# These Kubernetes API/client requirements are SUPPORTED-VERSION FLOORS: Go's
# minimal version selection means an adopter already on a newer client-go keeps it, while
# chasing patch releases here would force every adopter up to whatever we last built against.
# An adapter has no business dictating which Kubernetes libraries its host runs. Raising it is
# a deliberate act (it raises the supported minor), so it is not Dependabot's to make.
- dependency-name: k8s.io/*
# Other k8s.io modules remain eligible for updates.
- dependency-name: k8s.io/api
- dependency-name: k8s.io/apimachinery
- dependency-name: k8s.io/client-go
commit-message:
prefix: "chore(deps)"

Expand All @@ -46,6 +50,7 @@ updates:
groups:
npm:
patterns: ["*"]
update-types: ["minor", "patch"]
commit-message:
prefix: "chore(deps)"

Expand All @@ -57,6 +62,7 @@ updates:
groups:
npm:
patterns: ["*"]
update-types: ["minor", "patch"]
commit-message:
prefix: "chore(deps)"

Expand All @@ -68,5 +74,6 @@ updates:
groups:
npm:
patterns: ["*"]
update-types: ["minor", "patch"]
commit-message:
prefix: "chore(deps)"