chore(deps): pin dependencies #509
Conversation
BrunoQuaresma
commented
May 19, 2025
BrunoQuaresma
commented
- Pin dependencies
- Only auto update minors using dependabot
| @@ -6,7 +6,7 @@ | |||
| "repository": "https://github.com/coder/vscode-coder", | |||
| "version": "1.9.0", | |||
| "engines": { | |||
| "vscode": "^1.73.0" | |||
| "vscode": "1.73.0" | |||
There was a problem hiding this comment.
I am not sure if we should pin VS Code, as it is now on version 1.100. @code-asher can help us here.
There was a problem hiding this comment.
Yeah if we do this our extension will only run on VS Code 1.73.0.
| @@ -15,3 +15,6 @@ updates: | |||
| interval: "weekly" | |||
| ignore: | |||
| - dependency-name: "@types/vscode" | |||
| - dependency-name: "*" | |||
| update-types: | |||
| - version-update:semver-major | |||
There was a problem hiding this comment.
Perhaps we should also allow minor updates and reduce the frequency to once a month.
|
Why do we need to remove the Edit: to elaborate, we could similarly configure dependabot to ignore minor versions instead of changing the package.json. Although, I am not sure most packages will backport security fixes and the like, so unsure if we should actually do this. Will dependabot do a minor/major update even if we tell it not to, if the update is for security reasons? |
