mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 21:10:59 +00:00
Marc-André Bombeck
44c2973a64
Next 16.4.2 carries the fixes for GHSA-673q-mjm6-r5xr and GHSA-2464-fhr4-w9xw (unauthenticated remote code execution) and GHSA-p3m5-59mp-jv5r (denial of service through Server Actions). eslint-config-next and @next/bundle-analyzer move with it, both pinned exactly. nodemailer 10.1.7 fixes the address-parser advisories. The 16.4.0 ignore in the Dependabot config is gone: the history journeys it was guarding pass on 16.4.2 with the day-step fix, and the note says what was measured.
82 lines
3.4 KiB
YAML
82 lines
3.4 KiB
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
security-patches:
|
|
applies-to: security-updates
|
|
update-types:
|
|
- "patch"
|
|
# One weekly pull request per dependency kind instead of a trickle of
|
|
# single bumps: patch and minor updates travel together and pass the
|
|
# same checks once. Majors stay single so each gets its own review.
|
|
#
|
|
# The Next.js line travels alone. Its bumps are the ones that move
|
|
# URL state after history traversal (see the note on 16.4 below), and a
|
|
# red Next bump inside the group would hold every harmless update in
|
|
# it red as well.
|
|
production-weekly:
|
|
dependency-type: "production"
|
|
update-types:
|
|
- "patch"
|
|
- "minor"
|
|
exclude-patterns:
|
|
- "next"
|
|
development-weekly:
|
|
dependency-type: "development"
|
|
update-types:
|
|
- "patch"
|
|
- "minor"
|
|
exclude-patterns:
|
|
- "eslint-config-next"
|
|
- "@next/bundle-analyzer"
|
|
# No ignore for the Next.js line any more. 16.4.0 lost URL state after
|
|
# history traversal: with a sheet opened through `?doc=`, Back left it
|
|
# open, and `[` / `]` sometimes did not move `?day=` (3 of 40 repeated
|
|
# runs of three end-to-end journeys, 0 of 80 on 16.3.8). Measured on
|
|
# 16.4.2: the `?doc=` and dashboard journeys passed 80 of 80, the day keys
|
|
# still lost a step in 2 of 20, because a step started from the day the
|
|
# layer had last rendered and 16.4 lets that trail the URL. A step now
|
|
# starts from the URL itself; after that the three journeys passed 200 of
|
|
# 200 repeated runs and the day keys alone another 80 of 80.
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
groups:
|
|
# init, analyze and upload-sarif are one release pinned in three places.
|
|
# Bumped separately, a run mixes two versions and analyze refuses the
|
|
# config init wrote ("Loaded a configuration file for version 4.37.7, but
|
|
# running version 4.37.9"), so none of the single-action pull requests can
|
|
# reach green on its own. They travel together.
|
|
codeql-action:
|
|
patterns:
|
|
- "github/codeql-action*"
|
|
- package-ecosystem: "docker"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
# The `docker` ecosystem above reads the Dockerfile only. The bundled
|
|
# database lives in `docker-compose.yml`, which GitHub treats as its own
|
|
# ecosystem, so without this block a new PostgreSQL minor release never
|
|
# reaches us and the pin ages silently.
|
|
- package-ecosystem: "docker-compose"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
ignore:
|
|
# A PostgreSQL major is a migration, not an update: the on-disk format
|
|
# changes, so the operator has to run pg_upgrade or dump and restore.
|
|
# The first run of this ecosystem proposed 16.15 -> 18.6, which would
|
|
# have handed self-hosters a database their data directory cannot be
|
|
# read by. Minor releases still arrive as PRs; a major is a deliberate
|
|
# project decision with a migration guide behind it.
|
|
- dependency-name: "postgres"
|
|
update-types: ["version-update:semver-major"]
|