Niels Lohmann
017a3ce001
The Dependabot bump to 10.1.0 (#6059) conflicts with the pinned opentelemetry-api 1.37.0 (importlib-metadata<8.8.0), so the Semgrep job failed with ResolutionImpossible. Ignore importlib-metadata in Dependabot since semgrep pins it indirectly. Signed-off-by: Niels Lohmann <mail@nlohmann.me>
71 lines
1.8 KiB
YAML
71 lines
1.8 KiB
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: github-actions
|
|
directory: /
|
|
schedule:
|
|
interval: daily
|
|
cooldown:
|
|
default-days: 7
|
|
groups:
|
|
codeql-action:
|
|
patterns:
|
|
- "github/codeql-action/*"
|
|
|
|
- package-ecosystem: pip
|
|
directory: /docs/mkdocs
|
|
schedule:
|
|
interval: daily
|
|
cooldown:
|
|
default-days: 7
|
|
|
|
- package-ecosystem: npm
|
|
directory: /docs/mkdocs/scripts/mermaid
|
|
schedule:
|
|
interval: daily
|
|
cooldown:
|
|
default-days: 7
|
|
ignore:
|
|
# Material for MkDocs loads mermaid@11; keep the checker on the same major version
|
|
- dependency-name: mermaid
|
|
update-types: ["version-update:semver-major"]
|
|
|
|
- package-ecosystem: pip
|
|
directory: /tools/astyle
|
|
schedule:
|
|
interval: daily
|
|
cooldown:
|
|
default-days: 7
|
|
ignore:
|
|
# astyle is deliberately pinned (see tools/astyle/requirements.txt): newer versions
|
|
# reformat the code, and the pinned version defines the formatting CI enforces
|
|
- dependency-name: astyle
|
|
|
|
- package-ecosystem: pip
|
|
directory: /tools/generate_natvis
|
|
schedule:
|
|
interval: daily
|
|
cooldown:
|
|
default-days: 7
|
|
|
|
- package-ecosystem: pip
|
|
directory: /tools/serve_header
|
|
schedule:
|
|
interval: daily
|
|
cooldown:
|
|
default-days: 7
|
|
|
|
- package-ecosystem: pip
|
|
directory: /cmake/requirements
|
|
schedule:
|
|
interval: daily
|
|
cooldown:
|
|
default-days: 7
|
|
ignore:
|
|
# semgrep pins these packages to exact or compatible-release versions (see its METADATA);
|
|
# bumping them on their own makes the Semgrep job fail with ResolutionImpossible, so
|
|
# they only move together with a semgrep release
|
|
- dependency-name: mcp
|
|
- dependency-name: boltons
|
|
- dependency-name: "opentelemetry-*"
|
|
- dependency-name: importlib-metadata
|