Dependabot: group minor and patch only, majors on their own - #107
Merged
Conversation
The first grouped run put ten cargo bumps in one PR, three of them
breaking majors — sqlx 0.8->0.9, reqwest 0.12->0.13, md-5 0.10->0.11 —
producing 24 compile errors on all three platforms. The seven harmless
updates were stuck behind migrations nobody had scheduled, and all the PR
could report was that the batch was broken.
Grouping by ecosystem was the wrong axis. The useful split is whether a
human has to think: minor and patch batch up and merge on a green tick,
majors arrive alone and correctly attributed and wait until someone wants
to do the work. Per-ecosystem limits raised so the individual majors are
not starved by the group.
sqlx 0.9 is a real piece of work, not a bump: it introduces SqlStr and
rejects format!-built query strings outright ("dynamic SQL strings should
be audited for possible injections"), which is 21 of those 24 errors and
takes in CHANNEL_COLUMNS.
Noted while diagnosing: the glib moderate advisory cannot be fixed by any
dependency PR here. glib is transitive under the whole GTK stack that
Tauri uses for its Linux backend, so it moves when Tauri does. No
security fix is blocked behind the sqlx migration.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JaRQYbdzNiZaN4cbY5VFMx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The first grouped run (#104) put ten cargo bumps in one PR, three of them breaking majors —
sqlx 0.8→0.9,reqwest 0.12→0.13,md-5 0.10→0.11— producing 24 compile errors on all three platforms. The seven harmless updates were stuck behind migrations nobody had scheduled, and all the PR could say was "the batch is broken".Grouping by ecosystem was the wrong axis. The useful split is whether a human has to think:
Per-ecosystem limits raised so the individual majors aren't starved by the group.
What the three majors actually need
sqlx 0.8 → 0.9SqlStrand rejectsformat!-built queries outright — "dynamic SQL strings should be audited for possible injections". Takes inCHANNEL_COLUMNS,export.rs,backup.rs.reqwest 0.12 → 0.13RequestBuilder::queryremoved. One call site.md-5 0.10 → 0.11finalize()returnshybrid_array::Array, noUpperHex. One line aticf.rs:337.Noted while diagnosing
The
glibmoderate advisory cannot be fixed by any dependency PR here.glibis transitive under the entire GTK stack (gtk,gdk,webkit2gtk,atk,cairo-rs) that Tauri uses for its Linux backend, so it moves when Tauri does. Worth knowing because it means no security fix is blocked behind the sqlx migration — and it's Linux-only.Closes the approach that produced #104; that PR should be closed and left to regenerate under this config.
🤖 Generated with Claude Code
https://claude.ai/code/session_01JaRQYbdzNiZaN4cbY5VFMx