Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

openapi-generator-cli fights over package versions with dependabot #3634

Open
jyasskin opened this issue Jan 31, 2024 · 0 comments
Open

openapi-generator-cli fights over package versions with dependabot #3634

jyasskin opened this issue Jan 31, 2024 · 0 comments

Comments

@jyasskin
Copy link
Collaborator

The OpenAPI generator generates old versions of dependencies, like in 879ea78.

Then dependabot comes along in PRs like #3631 and upgrades them.

To avoid this:

  1. PR authors can manually undo the OpenAPI generator's changes to these dependency versions. This is a pain.
  2. We could automatically undo changes to these files in the script that calls the OpenAPI generator. This will cause us to miss real dependency updates if there ever are any.
  3. We could disable dependabot on these files. I'm not sure why dependabot is running on them in the first place, since we have
    - package-ecosystem: "npm"
    # Look for `package.json` and `lock` files in the `root` directory
    directory: "/"
    but adding new sections with directory: gen/js/chromestatus-openapi and directory: gen/py/chromestatus-openapi will hopefully let us ignore updates to those packages. This has the risk that it could leave vulnerable versions around, but it doesn't look like the dependencies of these libraries actually affect the versions installed for the main program.

What do y'all prefer?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant