Let Dependabot keep the workflow actions up to date - #62
Merged
Conversation
Dependabot has been configured here since 2022, but only for bundler, which has nothing to do: Gemfile.lock is not checked in, and the two version constraints that exist are deliberate - a floor of Active Record 7.0, and a ceiling of sqlite3 1.x for the matrix leg that tests against it. Meanwhile the ecosystem that did have something to say was never listed, and actions/checkout drifted four major versions behind until it was noticed by hand. So github-actions is now listed too, grouped into one pull request rather than one per action, and both ecosystems run weekly on the day the scheduled build already runs rather than daily. actions/checkout goes to v7 in the same breath, since that is the bump nobody was told about. Its steps are also indented under the sequence key, which is what the rest of the file and the new config do.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Housekeeping surfaced while closing out #61.
Dependabot was watching the wrong thing
.github/dependabot.ymlhas existed since January 2022, listing onlybundler— which has nothing to do here.Gemfile.lockis not checked in, and the only two version constraints in the repository are deliberate: a floor of Active Record 7.0 in the gemspec, and a ceiling of sqlite3 1.x for the matrix leg that tests against it. Any pull request Dependabot could open against either would be one to close.The ecosystem that did have something to say was never listed.
actions/checkoutwas four majors behind, and the only reason it came up is that it emits a Node-runtime deprecation warning on every job, which I noticed by hand rather than being told. Sogithub-actionsis listed now — grouped into a single pull request rather than one per action, and weekly on the day the scheduled build already runs rather than daily.actions/checkoutgoes to v7 here, since that is the bump nobody was told about. Itssteps:are also indented under the sequence key, matching the rest of the file and the new config; the YAML parses identically either way.Copyright years
2022 → 2026 in
LICENSEand the README.Not addressed
Dependabot reports a low-severity use-after-free in
sqlite3 <= 2.9.4, patched in 2.9.5. The unpinned legs already resolve to 2.9.5, so they are clear. TheACTIVE_RECORD_VERSION="~> 7.0.0"andACTIVE_RECORD_BRANCH="7-0-stable"legs cannot be: Active Record 7.0's sqlite3 adapter requiressqlite3 ~> 1.4, so< 2is load-bearing rather than stale. I confirmed that by removing the pin — Bundler resolves it happily, then every example errors withcan't activate sqlite3 (~> 1.4), already activated sqlite3-2.9.5.That leaves the alert open for as long as Active Record 7.0 is supported. It is a test-only dependency of a testing gem, and not a dependency of
with_modelitself, so nothing installing this gem is exposed. Worth a decision on whether to keep 7.0 in the matrix, but not one to make in this pull request.Each commit passes
bin/rakeon its own.