From 13b2ee52315eaed28ec8dcf5d4ed67292264fa4e Mon Sep 17 00:00:00 2001 From: kingchenc Date: Sun, 28 Jun 2026 00:53:10 +0200 Subject: [PATCH] =?UTF-8?q?ci(dependabot):=20split=20the=20cargo=20group?= =?UTF-8?q?=20=E2=80=94=20isolate=20napi,=20pin=20ureq=20to=202.x=20(#348)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The cargo group bundled every crate bump into one PR, which forced the napi-rs 3 migration (a coordinated CLI + crate major) together with an unrelated ureq bump. Give napi/napi-derive/napi-build their own group so the napi-3 work lands as a self-contained PR, and ignore ureq major updates: ureq 3 unconditionally pulls webpki-root-certs (CDLA-Permissive-2.0), which the native-tls / OS-trust-store setup in wickra-data deliberately avoids. --- .github/dependabot.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 93d395c4..a4ab8a21 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -10,9 +10,22 @@ updates: default-days: 7 commit-message: prefix: "deps(cargo)" + # ureq is intentionally pinned to 2.x. ureq 3 unconditionally pulls + # webpki-root-certs (CDLA-Permissive-2.0); the native-tls / OS-trust-store + # setup in wickra-data deliberately avoids that licence. Block the major + # bump (2.x patch/minor still flow through). + ignore: + - dependency-name: "ureq" + update-types: ["version-update:semver-major"] groups: + # napi-rs (napi / napi-derive / napi-build) is a coordinated major + # migration that must move with @napi-rs/cli on the npm side — keep it in + # its own PR rather than bundled with unrelated crate bumps. + napi: + patterns: ["napi", "napi-derive", "napi-build"] cargo: patterns: ["*"] + exclude-patterns: ["napi", "napi-derive", "napi-build"] # Node binding npm dependencies. - package-ecosystem: npm