Bump open from 2.1.1 to 2.1.2

[dependabot]

Bumps open from 2.1.1 to 2.1.2.

Release notes

Sourced from open's releases.

v2.1.2

Other

• add Heiku platform support

Commit Statistics

• 2 commits contributed to the release.
• 54 days passed between releases.
• 1 commit where understood as conventional.
• 0 issues like '(#ID)' where seen in commit messages

Commit Details

• Uncategorized
  • update changelog (45e0388)
  • add platform support (85f4dfd)

Changelog

Sourced from open's changelog.

2.1.2 (2022-04-29)

Other

• add Heiku platform support

Commit Statistics

• 2 commits contributed to the release.
• 54 days passed between releases.
• 1 commit where understood as conventional.
• 0 issues like '(#ID)' where seen in commit messages

Commit Details

• Uncategorized
  • update changelog (45e0388)
  • add platform support (85f4dfd)

Commits

• ee25446 Release open v2.1.2
• 45e0388 update changelog
• 85f4dfd haiku: add platform support
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @kylewillmon.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[cd-work]

Is dependabot just going to open a separate PR for every dependency?

[kylewillmon]

Is dependabot just going to open a separate PR for every dependency?

Yes... Time will tell if this gets annoying...

[cd-work]

Yes... Time will tell if this gets annoying...

I mean for me personally, it already has. Initially thought it was just for breaking changes, but if this is going to be the case for every dependency that's going to be a bit much. And pointlessly so because there really shouldn't be any reason to separate each dependency update into a separate PR.

Talking worst-case scenario, if the bot checks once a week and for some magical reason every dependency gets updated, that would be 260 PRs. Even though that's not going to happen picking a random number between 0-260 every week is not something that sounds enticing to me.

[kylewillmon]

Initially thought it was just for breaking changes

There may be a way to do this if we can get Dependabot to look at Cargo.toml only and ignore Cargo.lock. But then we would need something else to ensure that we are regularly picking up non-breaking changes.

that would be 260 PRs.

Dependabot limits itself to no more than 5 open PRs by default (and gives us full control to change that number).

[kylewillmon]

There may be a way to do this if we can get Dependabot to look at Cargo.toml only and ignore Cargo.lock. But then we would need something else to ensure that we are regularly picking up non-breaking changes.

I've found the ignore block used by other projects to limit this to major versions only.

    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-minor", "version-update:semver-patch"]

The linked repo uses it for a different reason though. They simply object to modifying Cargo.toml when it isn't necessary because it risks duplicating a dependency to satisfy the version. We can keep an eye on the PRs to see if that happens.

@dependabot squash and merge

[cd-work]

There may be a way to do this if we can get Dependabot to look at Cargo.toml only and ignore Cargo.lock. But then we would need something else to ensure that we are regularly picking up non-breaking changes.

Dependabot should never be changing the Cargo.toml in the first place for non-breaking version updates.

Dependabot limits itself to no more than 5 open PRs by default (and gives us full control to change that number).

So it will just stop opening PRs when it reaches this limit? I'd be surprised if there's less than 5 version updates each week.

The linked repo uses it for a different reason though. They simply object to modifying Cargo.toml when it isn't necessary because it risks duplicating a dependency to satisfy the version. We can keep an eye on the PRs to see if that happens.

I really don't see how anyone would have a different opinion on this. It's really the only approach that makes sense to me.

[dependabot]

Dependabot tried to merge this PR, but received the following error from GitHub:

Waiting on code owner review from phylum-dev/integrations and/or phylum-dev/user-components.