opensearch-project / opensearch-project/OpenSearch

[Feature Request] Increase simultaneous dependabot version bumps

Open
#17,564 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement Libraries
Dominant language
Java
Stars
13.7k
Forks
3k
Avg merge
2d 23h
Merged PRs (30d)
108

Description

Is your feature request related to a problem? Please describe

Dependabot is currently configured to have only one open version bump PR per module, with weekly updates. For example, here is the configuration for repository-azure
https://github.com/opensearch-project/OpenSearch/blob/9bef705d321d83b37f92292662c80a5e0cb4ba66/.github/dependabot.yml#L950-L954

While this appears intended to reduce PR spam from version bumps, it has an unfortunate side effect. When a version bump is stalled for some reason, no other version bumps go through. See for example:

This is significant because the version of a completely different dependency was never bumped, despite being needed to resolve CVE-2024-57699, published Feb 5 (33 days ago).

Describe the solution you'd like

Increase the limit of open PRs to 2, to prevent a single stalled version bump from blocking all others for a module.

Related component

Libraries

Describe alternatives you've considered
  • Change dependency management to Mend Remediate. While the same PR throttling limits (and more flexibility) is included, it provides a "Dependency Dashboard" where one can also view pending PRs which have been throttled, and click a box to request a PR; a good workflow to establish in the run-up to a release when fixing CVEs should be a priority.
  • Investigate any other way to prioritize CVE-fixing version bumps
Additional context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Inspect .github/dependabot.yml around lines 950-954, where the repository-azure configuration limits open version-bump pull requests. Update the limit from one to two and verify that the Dependabot configuration remains valid; the requested behavior is allowing two simultaneous version-bump PRs per module.

Written by the indexing model from the issue text.

Assessment

Tech stack
github
Domain
ci-cd, devops
Issue type
Feature
Difficulty
1/5
Estimated time
Under an hour
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.