chore: pin dependencies and enable dependabot #388
Conversation
| boto3>=1.10.0 | ||
| cryptography>=2.5.0 | ||
| attrs>=17.4.0 | ||
| wrapt>=1.10.11 | ||
| boto3==1.20.24 | ||
| cryptography==36.0.1 | ||
| attrs==21.2.0 | ||
| wrapt==1.13.3 |
There was a problem hiding this comment.
I think that this is a bad idea. Why? Our customers now cannot use different versions of these dependencies in their environments. I recommend reverting the changes in this file.
There was a problem hiding this comment.
Explicitly inform us that Dependabot will consider test/requirements.txt.
Undo your changes to requirements.txt. I would rather let dependabot tell us version XYZ has a security issue so use >=ABC then commit to pinning to these latest versions that our customer's may not have in their environments yet.
I favor flexible dependencies to accommodate our customers... but I could be wrong.
| boto3>=1.10.0 | ||
| cryptography>=2.5.0 | ||
| attrs>=17.4.0 | ||
| wrapt>=1.10.11 | ||
| boto3==1.20.24 | ||
| cryptography==36.0.1 | ||
| attrs==21.2.0 | ||
| wrapt==1.13.3 |
There was a problem hiding this comment.
I think that this is a bad idea. Why? Our customers now cannot use different versions of these dependencies in their environments. I recommend reverting the changes in this file.
| version: 2 | ||
| updates: | ||
| - package-ecosystem: "pip" | ||
| directory: "/" | ||
| schedule: | ||
| interval: "daily" | ||
| - package-ecosystem: "pip" | ||
| directory: "/" | ||
| schedule: | ||
| interval: "daily" | ||
| target-branch: "mainline-1.x" | ||
| - package-ecosystem: "pip" | ||
| directory: "/" | ||
| schedule: | ||
| interval: "daily" | ||
| target-branch: "mainline-2.x" | ||
| - package-ecosystem: "github-actions" | ||
| directory: "/" | ||
| schedule: | ||
| interval: "daily" |
There was a problem hiding this comment.
Do we know if dependabot will make recommendations for any requirements file? Or will it only think about the requirements file in root directory and ignore test/requirements.txt?
There was a problem hiding this comment.
It'll look at any requirements file, it's the same way with the ddbec-java repo. There are two pom.xml files, one in the root and one in sdk1/
|
Closing in favor of #389 |
Description of changes:
Pins the following dependencies:
boto3, cryptography, attrs, wraptmock, pytest, pytest-cov, pytest-mock, bandit, doc8, flake8, pylint, black, isortWhy were those versions picked?
I picked these versions from the last successful github actions workflow.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
Check any applicable: