typelevel / typelevel/sbt-typelevel
Configurable configs-ignore
Nobody has claimed this yet.
- Dominant language
- Scala
- Stars
- 185
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
Following up on https://github.com/typelevel/sbt-typelevel/issues/442, I still think we want it to be configurable.
Use case: we do a lot of runtime dependency overrides when upstream lags behind our security requirements. Under this technique, the compile dependency remains the old, transitive, vulnerable version, but it is evicted at runtime. Our tooling filters compile and compile-internal. This gives us full protection of our runtime classpath (i.e., what's in prod), while maintaining a tidy set of explicit compile dependencies.
I also think compile and compile-internal would be reasonable defaults to omit.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked sbt-typelevel issue #442 and the referenced build.sbt runtime dependency override example. Trace how configs-ignore is currently selected, then define how it becomes configurable while retaining compile and compile-internal as defaults. Done means the runtime override use case can omit those configurations without weakening the existing dependency filtering.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- scala
- Domain
- build-system
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100