@@ -4,63 +4,16 @@ updates:
4
4
directory : /
5
5
schedule :
6
6
interval : daily
7
- # Cargo major version update notifications (PRs) we always want
8
7
- package-ecosystem : cargo
9
8
directory : /
10
- ignore :
11
- - dependency-name : " *"
12
- update-types :
13
- - " version-update:semver-patch"
14
- - " version-update:semver-minor"
15
9
schedule :
16
- # we want to know about them immediately
17
10
interval : daily
18
- groups :
19
- # we group major bumps for dev-dependencies together in case there are
20
- # related groups of breaking changes. that _can_ be the case for
21
- # production dependencies too, but there one should be more diligent
22
- # about each major bump in case it constitutes a breaking change to the
23
- # current crate too.
24
- major-dev :
25
- dependency-type : " development"
26
- update-types :
27
- - " major"
28
- # patch and minor updates don't matter for libraries, as consumers of a
29
- # library build with their own lockfile, rather than the version specified in
30
- # this library's lockfile. so for libraries (which is most crates), we should
31
- # never update non-major versions, and so the following rule is disabled by
32
- # default.
33
- #
34
- # if your package has binaries, enable this rule by commenting out the
35
- # `open-pull-requests-limit` line. this will open a PR once a month that
36
- # effectively runs `cargo update` to ensure that the binaries are built with
37
- # the exact set of dependencies and those are up to date.
38
- - package-ecosystem : cargo
39
- # this rule is disabled by default; comment out this line to re-enable:
40
- open-pull-requests-limit : 0
41
- directory : /
42
- schedule :
43
- interval : monthly
44
- # select only minor + patch by excluding major. dependabot doesn't appear
45
- # to have an include-only rule, so we have to do it by exclusion.
46
11
ignore :
47
12
- dependency-name : " *"
13
+ # patch and minor updates don't matter for libraries as consumers of this library build
14
+ # with their own lockfile, rather than the version specified in this library's lockfile
15
+ # remove this ignore rule if your package has binaries to ensure that the binaries are
16
+ # built with the exact set of dependencies and those are up to date.
48
17
update-types :
49
- - " version-update:semver-major"
50
- # never bump the version in `Cargo.toml` for minor/patch upgrades; it
51
- # should only change when the major version changes to avoid requiring
52
- # downstream packages from also running a `cargo update` (and possibly
53
- # bumping MSRV unnecessarily as a result).
54
- #
55
- # TODO: https://github.com/dependabot/dependabot-core/issues/4009
56
- # versioning-strategy: "increase-if-necessary"
57
- versioning-strategy : " lockfile-only"
58
- groups :
59
- # note that since this is perfectly disjoint with the `ignore` rule, all
60
- # minor/patch updates will end up in a single group, and thus in a single
61
- # PR. grouping all of these together only (generally) works because the
62
- # Rust community is fairly good about respecting semver.
63
- cargo-update :
64
- update-types :
65
- - " minor"
66
- - " patch"
18
+ - " version-update:semver-patch"
19
+ - " version-update:semver-minor"
0 commit comments