Bump boto3 from 1.43.0 to 1.43.39 in /src - #311
Conversation
Bumps [boto3](https://github.com/boto/boto3) from 1.43.0 to 1.43.39. - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.43.0...1.43.39) --- updated-dependencies: - dependency-name: boto3 dependency-version: 1.43.39 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
| [packages] | ||
| # Minimum version for IMDSv2 support | ||
| boto3 = ">=1.43.0" | ||
| boto3 = ">=1.43.39" |
There was a problem hiding this comment.
@mcdonnnj - What do you think we should do in cases like this. I think we do not want the boto3 version bump in this file, but we do want the changes to Pipfile.lock.
There was a problem hiding this comment.
If we leave this unchanged at >=1.43.0, do we know if Dependabot will try to upgrade it next time, when it opens a PR like Bump boto3 from 1.43.39 to 1.43.40 in /src?
There was a problem hiding this comment.
Yes, it will. But the lower bound pin is there only for the reason specified in the comment and need not match the version in the Pipfile.lock file. If we change the pin we should also update the comment to...something. It doesn't make sense to me to make it match the Pipfile.lock file for no reason.
There was a problem hiding this comment.
I agree that the minimum version pin should not be changed unless there is a reason to change it. There doesn't seem to be a way to tell Dependabot to ignore just this line, what if we just give ourselves a breadcrumb like:
| boto3 = ">=1.43.39" | |
| boto3 = ">=1.43.0" # Don't blindly let Dependabot change this; update only when minimum version changes |
There was a problem hiding this comment.
A bit more Googling has led me to the versioning-strategy: lockfile-only option in our dependabot.yml. According to the docs, using that option will:
Only create pull requests to update lockfiles. Ignore any new versions that would require package manifest changes.
There was a problem hiding this comment.
Late to the party but I agree that we don't want the lower bound to change unless we have a specific functionality requirement that forces it.
|
Superseded by #313. |
This choice should help with PRs such as cisagov/skeleton-generic#279 and cisagov/code-gov-update#311, where previously Dependabot wanted to incorrectly force the new version as a lower bound constraint into the Pipfile or requirements.txt file. According to the AIs: You would choose increase-if-necessary over lockfile-only when you want Dependabot to automatically update your manifest file (e.g., package.json, Cargo.toml) whenever a new dependency version falls outside your currently defined semantic version (semver) range. It makes sense to use lockfile-only instead of increase-if-necessary when your primary goal is to minimize manifest churn and you prefer to handle major or breaking dependency upgrades manually. Choose lockfile-only if: - You only want automated PRs for security and bug fixes. - You want zero changes to your main manifest file from bots. - You prefer upgrading major tools (like upgrading from Webpack 4 to 5) manually. Choose increase-if-necessary if: - You want the bot to handle both security patches and major version upgrades automatically. Co-authored-by: dav3r <david.redmin@gwe.cisa.dhs.gov>
3 participants
Bumps boto3 from 1.43.0 to 1.43.39.
Commits
121db7aMerge branch 'release-1.43.39'310317dBumping version to 1.43.39ff7c1cfAdd changelog entries from botocore805c683Update CODEOWNERS to shared Python SDK and CLI team (#4809)efcfb65Merge branch 'release-1.43.38'd7aa957Merge branch 'release-1.43.38' into developc5ccc0dBumping version to 1.43.382f87c21Add changelog entries from botocoreaf4ce8dMerge branch 'release-1.43.37'1d2f989Merge branch 'release-1.43.37' into developDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)