Dependabot/renovate bot: some dependencies are not getting bumped

[flavio]

This issue is not specific to this repository. We've seen on certain repositories that dependabot and renovate bot are not proposing updates for certain dependencies (both libraries and GH actions).

We don't understand what might be the cause of this behaviour.

[flavio]

Currently, the kwctl project is using lazy_static version 1.4, but 1.5.0 is already out. We never got a dependency bump request neither from dependabot nor from renovatebot about that dependency

[flavio]

Update: the bots are not updating the Cargo.toml, but they are updating the Cargo.lock files. For example, policy-fetcher is requiring docker_credential = "1.2", but currently there's version 1.3.X out. However, inside of kwctl's Cargo.lock file, the latest version of docker_credentials is being consumed.

Also, it looks like renovate is misconfigured inside of policy-fetcher repository.

Action items:

• check renovate bot configurations
• switch to renovate bot only
• have patch dependencies PRs grouped together, with auto-merge
• have Cargo.lock updates be automatically merged
• review major and minor manually

Some useful information about how Rancher uses renovate

[jvanz]

Moving to TODO because we have other priorities for v1.20 release.