mirror of
https://github.com/theupdateframework/python-tuf
synced 2026-05-24 10:08:28 +00:00
cb164ec1f7
New releases of the transitive (via 'requests') dependency 'idna' break Python 2.7 builds. To fix this we configure dependabot to not bump 'idna' in requirements-pinned.txt, which lists and auto-updates all immediate and transitive dependencies for CI/CD testing. An alternative would be to add and restrict 'idna' in 'requirements.txt' but this is less preferable because 'requirements.txt' should only have direct dependencies. For consulted dependabot config docs see: https://docs.github.com/en/free-pro-team@latest/github/administering-a-repository/enabling-and-disabling-version-updates#disabling-dependabot-version-updates Signed-off-by: Lukas Puehringer <lukas.puehringer@nyu.edu>
13 lines
406 B
YAML
13 lines
406 B
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: pip
|
|
directory: "/"
|
|
schedule:
|
|
interval: daily
|
|
time: "10:00"
|
|
open-pull-requests-limit: 10
|
|
ignore:
|
|
# New 'idna' (see 'requests') releases break Python 2.7 builds. Ignore here
|
|
# to avoid listing/pinning transitive dependencies in requirements.txt.
|
|
# FIXME: Un-ignore when dropping Python 2.7 or resolving #1249
|
|
- dependency-name: "idna"
|