-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[CI] Dependabot to run on all packages. Pin Packages. Remove unused packages #4795
Conversation
Codecov Report
@@ Coverage Diff @@
## master #4795 +/- ##
==========================================
- Coverage 56.83% 56.83% -0.01%
==========================================
Files 722 722
Lines 22819 22819
Branches 1658 1658
==========================================
- Hits 12970 12969 -1
- Misses 9432 9433 +1
Partials 417 417
Continue to review full report at Codecov.
|
This reverts commit 6064f52.
We should disallow certain dependency updates like angular, webpack etc. |
"style-loader": "^1.0.1", | ||
"uuid": "^3.3.3", | ||
"v8-compile-cache": "^1.1.0", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Don't see any reference to this
"file-saver": "1.3.8", | ||
"git-rev-sync": "1.4.0", | ||
"html-loader": "0.5.5", | ||
"html2canvas": "1.4.1", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
bump
"css-loader": "^4.0.0", | ||
"comma-separated-values": "3.6.4", | ||
"copy-webpack-plugin": "10.2.0", | ||
"core-js": "3.20.3", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is not a direct dependency but one which is used in many of the webpack / linting libraries
Since angular is going to be removed, I think we can use the @dependabot ignore syntax when that package comes up. Webpack should be bumped now that we have some level of e2e coverage and an exhaustive node testing chain |
Agree, the dependabot workflow works better for our purposes. Reviewer Checklist
|
I notice that this removes the |
Closes
#4794
#3178
#4808
Describe your changes:
This will remove the allowlist for dependabot and allow it to scan all of our dependencies for changes.
Pin as many packages as we can
Remove as many packages as we can
All Submissions:
Author Checklist
Reviewer Checklist