-
Notifications
You must be signed in to change notification settings - Fork 9.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
dependency: bump dependabot dependencies #15862
Conversation
Signed-off-by: Prasad Chandrasekaran <prasadc@vmware.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM - Thanks for taking care of dependencies this week @pchan 🙏🏻
When we bump a dependency of mixed case, in which some modules directly while others indirectly depend on a dependency, we should try to bump the dependency for all modules, no matter it's direct or indirect dependency. Let's use |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please try to ensure all modules depend on the same version of each dependency.
ping @pchan Please try to get this PR done this week, as there will be another round of dependency bumping next week. |
Signed-off-by: Prasad Chandrasekaran <prasadc@vmware.com>
Signed-off-by: Prasad Chandrasekaran <prasadc@vmware.com>
When I went through the indirect section (link) of the guide, I got the impression that we will have to update indirect dependencies only via upgrading direct dependencies. This would have involved analysing dependency graph etc. But all I had to do was to use |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM.
Should indirect dependencies specified in tools/go.mod
be upgraded? For example github.com/zmap/zlint/v3
. From the guidance, looks like not. It's not a big issue though.
No matter direct or indirect dependency, once we decide to bump it, we follow the same guide below, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Thanks @pchan
Correct. I will let it in this time, but please try to follow #indirect-dependencies. |
Should indirect dependencies specified in tools/go.mod be upgraded? For
example github.com/zmap/zlint/v3. From the guidance
<https://github.com/etcd-io/etcd/blob/main/Documentation/contributor-guide/dependency_management.md#indirect-dependencies>,
looks like not. It's not a big issue though.
Can you please help me understand which indirect dependency you
are referring to? I upgraded the one in tools/mod/go.mod from
github.com/zmap/zlint/v3 v3.1.0
to
github.com/zmap/zlint/v3 v3.4.1
Please see commit
db07ec9
… Message ID: ***@***.***>
|
Can you please be specific on which indirect dependency was left out. The commit db07ec9 addresses the zmap/zlint one. I had added it as a separate commit. Every dependabot PR marked as complete in #15862 (comment) can be closed |
Note that FYI. |
@ahrtr Thanks for taking this follow-up! |
Thanks for the context. To find the direct dependency, I ran the [1]
[2]
|
Please read https://github.com/etcd-io/etcd/blob/main/CONTRIBUTING.md#contribution-flow.
I have manually bumped the following direct dependencies. Only the first one below has been raised by dependabot. The rest were raised as indirect dependencies.
A lot of dependencies in tools/mod are indirect dependencies so haven't bumped them.
cc: @ahrtr @jmhbnz