Skip to content

Commit

Permalink
ci: disable dependabot version updates
Browse files Browse the repository at this point in the history
Enforcing newest versions of Darker's dependencies may cause a problem
for those users who like to install Darker in the same environment as
the package they are reformatting. Their package may have an upper
version limit for a dependency, e.g. to prevent an unintended update to
an incompatible major version. If Darker then requires a minimum version
newer than that limit, the installation of Darker will fail.

It's reasonable to keep Dependabot security updates (based on the Github
Advisory Database) enabled, but for the above reasons, Dependabot
version updates should in my opinion be disabled. We should support
oldest possible non-vulnerable versions of our dependencies, and yet in
a fresh environment users will still get the newest versions
automatically installed.

See also #788
  • Loading branch information
akaihola committed Jan 2, 2025
1 parent d3f96a2 commit 8f2caa2
Showing 1 changed file with 0 additions and 9 deletions.
9 changes: 0 additions & 9 deletions .github/dependabot.yml

This file was deleted.

0 comments on commit 8f2caa2

Please sign in to comment.