Haozhe Wu
58363fc01f
Dependabot could not land either half of a mutually-blocking pair: the minor/patch group wanted ccxt 4.5.68 (which pins setuptools==83.0.0) while keeping setuptools at 82.0.1, and the separate setuptools 83.0.0 PR conflicted with the ccxt 4.5.67 already in the lock. Neither can go green alone because setuptools is a major bump and is excluded from the minor/patch group by design, so it cannot ride along. Regenerate the lock so both move together. Verified with pip-compile under Python 3.11 on Linux (matching CI) and checked with CI's own gate, pip install --dry-run --require-hashes. Note the lock is platform-sensitive: regenerating on macOS drops jeepney/secretstorage and swaps py-mini-racer for mini-racer, so it must be produced on Linux. Also ignore websockets, capped at <16 by langgraph-sdk 0.4.2, and move all three ecosystems to monthly with 2 concurrent PRs. Security updates are a separate channel and are unaffected.
65 lines
2.6 KiB
YAML
65 lines
2.6 KiB
YAML
version: 2
|
|
updates:
|
|
# Root Python project (pyproject.toml).
|
|
- package-ecosystem: "pip"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "monthly"
|
|
open-pull-requests-limit: 2
|
|
groups:
|
|
# Minor/patch bumps are low-risk and reviewed as a single batch; majors
|
|
# are excluded so they still arrive individually and get real scrutiny
|
|
# (a batched PR mixing 10 patch bumps with 1 breaking major is worse
|
|
# than either alone — you can't reject just the major).
|
|
pip-minor-patch:
|
|
applies-to: version-updates
|
|
update-types: ["minor", "patch"]
|
|
ignore:
|
|
# pandas 3.x has real breaking changes (Copy-on-Write always-on, removed
|
|
# deprecated APIs) we haven't vetted; the <3.0.0 ceiling is deliberate,
|
|
# not an oversight. Revisit as a dedicated migration, not a dep bump.
|
|
- dependency-name: "pandas"
|
|
update-types: ["version-update:semver-major"]
|
|
# caio is capped by our own dependency tree, not by choice: aiofile
|
|
# 3.11.1 (latest) requires caio~=0.9.0, so any bump to caio 0.10.x makes
|
|
# `pip install` unresolvable. Dependabot kept proposing it and the group
|
|
# PR failed CI with ResolutionImpossible. Drop this ignore once aiofile
|
|
# ships a release that accepts caio 0.10.
|
|
- dependency-name: "caio"
|
|
# websockets is likewise capped by our tree: langgraph-sdk 0.4.2 requires
|
|
# websockets<16, so a bump to 16.x is unresolvable. Drop this once
|
|
# langgraph-sdk widens its range.
|
|
- dependency-name: "websockets"
|
|
|
|
# Frontend npm dependencies.
|
|
- package-ecosystem: "npm"
|
|
directory: "/frontend"
|
|
schedule:
|
|
interval: "monthly"
|
|
open-pull-requests-limit: 2
|
|
groups:
|
|
npm-minor-patch:
|
|
applies-to: version-updates
|
|
update-types: ["minor", "patch"]
|
|
ignore:
|
|
# Both majors are blocked on infrastructure migrations we have not done,
|
|
# so they can only sit red. Same rationale as the pandas pin above:
|
|
# revisit each as a dedicated migration, not a dependency bump.
|
|
# @vitejs/plugin-react 6.x peers vite@^8 (we are on vite 6.x).
|
|
# @testing-library/jest-dom 7.x requires Node >=22 (CI/Docker use 20).
|
|
- dependency-name: "@vitejs/plugin-react"
|
|
update-types: ["version-update:semver-major"]
|
|
- dependency-name: "@testing-library/jest-dom"
|
|
update-types: ["version-update:semver-major"]
|
|
|
|
# GitHub Actions workflow pins.
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "monthly"
|
|
open-pull-requests-limit: 2
|
|
groups:
|
|
actions-minor-patch:
|
|
applies-to: version-updates
|
|
update-types: ["minor", "patch"]
|