Tracking issue for automated dependency updates opened by Dependabot.
The repository convention is that every pull request links to an issue.
Dependabot cannot add that link itself, so this issue stands in for all of
them: when reviewing or merging a Dependabot pull request, reference this
issue number so the merge is traceable the same way a hand-written one is.
Covered by .github/dependabot.yml:
docker on /, weekly. Keeps the digest pins on the UBI base images in the
Dockerfile current. Each bump runs the container workflow, so the smoke
test decides whether the new base image is acceptable.github-actions on /, weekly. The workflows pin actions by major tag, so
these are mostly major version moves.cargo on /, weekly. Minor and patch updates are grouped into a single
pull request to keep the volume down; major updates come separately.
This issue stays open. Close it only if Dependabot is removed from the
repository.
Tracking issue for automated dependency updates opened by Dependabot.
The repository convention is that every pull request links to an issue.
Dependabot cannot add that link itself, so this issue stands in for all of
them: when reviewing or merging a Dependabot pull request, reference this
issue number so the merge is traceable the same way a hand-written one is.
Covered by
.github/dependabot.yml:dockeron/, weekly. Keeps the digest pins on the UBI base images in theDockerfilecurrent. Each bump runs the container workflow, so the smoketest decides whether the new base image is acceptable.
github-actionson/, weekly. The workflows pin actions by major tag, sothese are mostly major version moves.
cargoon/, weekly. Minor and patch updates are grouped into a singlepull request to keep the volume down; major updates come separately.
This issue stays open. Close it only if Dependabot is removed from the
repository.