Skip to content

Bump boto3 from 1.43.0 to 1.43.39 in /src #311

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

Bump boto3 from 1.43.0 to 1.43.39 in /src #311

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/Pipfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ name = "pypi"

[packages]
# Minimum version for IMDSv2 support
boto3 = ">=1.43.0"
boto3 = ">=1.43.39"

@jsf9k jsf9k Jul 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mcdonnnj - What do you think we should do in cases like this. I think we do not want the boto3 version bump in this file, but we do want the changes to Pipfile.lock.

@dav3r dav3r Jul 2, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we leave this unchanged at >=1.43.0, do we know if Dependabot will try to upgrade it next time, when it opens a PR like Bump boto3 from 1.43.39 to 1.43.40 in /src?

@jsf9k jsf9k Jul 2, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, it will. But the lower bound pin is there only for the reason specified in the comment and need not match the version in the Pipfile.lock file. If we change the pin we should also update the comment to...something. It doesn't make sense to me to make it match the Pipfile.lock file for no reason.

@dav3r dav3r Jul 2, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree that the minimum version pin should not be changed unless there is a reason to change it. There doesn't seem to be a way to tell Dependabot to ignore just this line, what if we just give ourselves a breadcrumb like:

Suggested change
boto3 = ">=1.43.39"
boto3 = ">=1.43.0" # Don't blindly let Dependabot change this; update only when minimum version changes

@dav3r dav3r Jul 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A bit more Googling has led me to the versioning-strategy: lockfile-only option in our dependabot.yml. According to the docs, using that option will:

Only create pull requests to update lockfiles. Ignore any new versions that would require package manifest changes.

@mcdonnnj mcdonnnj Jul 9, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Late to the party but I agree that we don't want the lower bound to change unless we have a specific functionality requirement that forces it.

# We need to use the system package version of this package. This matches the version
# available for Alpine Linux 3.23. We must also ignore dependabot updates for this
# dependency as long as we are using the system package.
Expand Down
21 changes: 10 additions & 11 deletions src/Pipfile.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading