opensearch-project / opensearch-project/OpenSearch
[Feature Request] Increase simultaneous dependabot version bumps
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 13.7k
- Forks
- 3k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 108
Description
Is your feature request related to a problem? Please describe
Dependabot is currently configured to have only one open version bump PR per module, with weekly updates. For example, here is the configuration for repository-azure
https://github.com/opensearch-project/OpenSearch/blob/9bef705d321d83b37f92292662c80a5e0cb4ba66/.github/dependabot.yml#L950-L954
While this appears intended to reduce PR spam from version bumps, it has an unfortunate side effect. When a version bump is stalled for some reason, no other version bumps go through. See for example:
- https://github.com/opensearch-project/OpenSearch/pull/17059 (Jan 20), superceded by
- https://github.com/opensearch-project/OpenSearch/pull/17562 (today)
This is significant because the version of a completely different dependency was never bumped, despite being needed to resolve CVE-2024-57699, published Feb 5 (33 days ago).
Describe the solution you'd like
Increase the limit of open PRs to 2, to prevent a single stalled version bump from blocking all others for a module.
Related component
Libraries
Describe alternatives you've considered
- Change dependency management to Mend Remediate. While the same PR throttling limits (and more flexibility) is included, it provides a "Dependency Dashboard" where one can also view pending PRs which have been throttled, and click a box to request a PR; a good workflow to establish in the run-up to a release when fixing CVEs should be a priority.
- Investigate any other way to prioritize CVE-fixing version bumps
Additional context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect .github/dependabot.yml around lines 950-954, where the repository-azure configuration limits open version-bump pull requests. Update the limit from one to two and verify that the Dependabot configuration remains valid; the requested behavior is allowing two simultaneous version-bump PRs per module.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github
- Domain
- ci-cd, devops
- Issue type
- Feature
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100