Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ci: disable dependabot version updates
Enforcing newest versions of Darker's dependencies may cause a problem for those users who like to install Darker in the same environment as the package they are reformatting. Their package may have an upper version limit for a dependency, e.g. to prevent an unintended update to an incompatible major version. If Darker then requires a minimum version newer than that limit, the installation of Darker will fail. It's reasonable to keep Dependabot security updates (based on the Github Advisory Database) enabled, but for the above reasons, Dependabot version updates should in my opinion be disabled. We should support oldest possible non-vulnerable versions of our dependencies, and yet in a fresh environment users will still get the newest versions automatically installed. See also #788
- Loading branch information