.github/dependabot.yml - develop - vshmidt/streamlit

.github/dependabot.yml
164 строки5 KB
Lukas Masuch
Pause component-lib dependency updates, enable security updates only (#13895)
10 фев 2026, 20:44
10 фев 2026, 20:44122bfae
version: 2
updates:
  # Keep package.json (& lockfiles) up to date as soon as
  # new versions are published to the npm registry
  - package-ecosystem: "npm"
    directory: "/frontend"
    schedule:
      interval: "daily"
    # Allow a limited number of update PRs at a time
    # to keep the number of parallel dependency updates manageable.
    open-pull-requests-limit: 5

    # Use cooldown to avoid updating dependencies too frequently
    # and minimize risk of supply chain attacks.
    cooldown:
      default-days: 5

    labels:
      - "change:chore"
      - "impact:internal"
      - "autofix"

    ignore:
      - dependency-name: "baseui"
        # 12->13: Needs to restyle date picker
        # 13->14: Requires rewrites of lots of overrides
        versions: [">=12.3.0"]
      - dependency-name: "iframe-resizer"
        # The license was changed to GPL-3 with the 4.4.0 update.
        # We pin the version to the last version under MIT licenses.
        versions: [">=4.4.0"]
      - dependency-name: "mapbox-gl"
        # The license was changed with the 2.0 major version update.
        versions: [">=2.0.0"]
      - dependency-name: "react-map-gl"
        # The license was changed with the mapbox-gl update.
        versions: [">=5.4.0"]
      - dependency-name: "ua-parser-js"
        # The license was changed to AGPLv3 with the 2.0 major version update.
        versions: [">=2.0.0"]
      - dependency-name: "react"
        # Updating react will need some extra work.
        versions: [">=19.0.0"]
      - dependency-name: "react-dom"
        # Updating react will need some extra work.
        versions: [">=19.0.0"]
      - dependency-name: "jsdom"
        # Breaks some of our RTL unit tests
        versions: [">=25.0.0"]
      - dependency-name: "sass"
        # Breaks our build process, needs more investigation
        versions: [">=1.80.0"]
      - dependency-name: "react-window"
        # This requires us to update baseui, since that has a dependency on react-window v1.
        versions: [">=2.0.0"]
      - dependency-name: "@types/node"
        # Our types should match the version of node we're using as defined in `.nvmrc`
        versions: [">=25.0.0"]

    groups:
      deck-gl:
        patterns:
          - "@deck.gl/*"
          - "deck.gl"
          - "@loaders.gl/*"
          - "mapbox-gl"
      vega:
        patterns:
          - "vega"
          - "vega-*"
      glide-data-grid:
        patterns:
          - "@glideapps/glide-data-grid*"
      markdown-processing:
        patterns:
          - "remark-*"
          - "rehype-*"
          - "react-markdown"
          - "unified"
      eslint:
        patterns:
          - "*eslint*"
      emotion:
        patterns:
          - "*emotion*"
      vitest:
        patterns:
          - "*vitest*"
      vite:
        patterns:
          - "vite"
          - "vite-*"
          - "@vitejs/*"
          # Due to the coupling between vite plugins and underlying swc
          # versions, it makes sense to keep these grouped together
          - "@swc/*"

  # Security updates are still included, but normal updates are paused
  # until we make a decision on the future of CC v1.
  - package-ecosystem: "npm"
    directory: "/component-lib"
    schedule:
      interval: "daily"
    open-pull-requests-limit: 0

    labels:
      - "change:chore"
      - "impact:internal"
      - "autofix"

  # Keep python dependencies up to date (via uv)
  # Root pyproject.toml contains dev/test dependency groups
  - package-ecosystem: "uv"
    directory: "/"
    schedule:
      interval: "daily"
    # Allow a limited number of update PRs at a time
    # to keep the number of parallel dependency updates manageable.
    open-pull-requests-limit: 3

    # Use cooldown to avoid updating dependencies too frequently
    # and minimize risk of supply chain attacks.
    cooldown:
      default-days: 5

    labels:
      - "change:chore"
      - "impact:internal"
      - "autofix"

    ignore:
      - dependency-name: "langchain"
        # Newer langchain version conflict with our test setup
        # see: https://github.com/streamlit/streamlit/pull/10227
        versions: [">=0.3.21"]
      - dependency-name: "langchain-community"
        versions: [">=0.3.14"]

  # Keep streamlit package runtime dependencies up to date
  # lib/pyproject.toml contains the published package's dependencies
  - package-ecosystem: "uv"
    directory: "/lib"
    schedule:
      interval: "daily"
    open-pull-requests-limit: 3

    cooldown:
      default-days: 5

    labels:
      - "change:chore"
      - "impact:users"
      - "autofix"

  # Maintain dependencies in GitHub Actions workflows
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

    labels:
      - "change:chore"
      - "impact:internal"
      - "autofix"