Conversation
BrunoQuaresma
commented
May 19, 2025
BrunoQuaresma
commented
- Pin dependencies
- Only auto update minors using dependabot
| "version": "1.9.0", | ||
| "engines": { | ||
| "vscode": "^1.73.0" | ||
| "vscode": "1.73.0" |
There was a problem hiding this comment.
I am not sure if we should pin VS Code, as it is now on version 1.100. @code-asher can help us here.
There was a problem hiding this comment.
Yeah if we do this our extension will only run on VS Code 1.73.0.
| - dependency-name: "@types/vscode" | ||
| - dependency-name: "*" | ||
| update-types: | ||
| - version-update:semver-major |
There was a problem hiding this comment.
Perhaps we should also allow minor updates and reduce the frequency to once a month.
|
Why do we need to remove the Edit: to elaborate, we could similarly configure dependabot to ignore minor versions instead of changing the package.json. Although, I am not sure most packages will backport security fixes and the like, so unsure if we should actually do this. Will dependabot do a minor/major update even if we tell it not to, if the update is for security reasons? |
3 participants
