Skip to content

Widen oa-configurator and orm-loader pins to semver ranges, add min-version CI and Dependabot#40

Open
nicoloesch wants to merge 2 commits into
mainfrom
39-dep-version-range
Open

Widen oa-configurator and orm-loader pins to semver ranges, add min-version CI and Dependabot#40
nicoloesch wants to merge 2 commits into
mainfrom
39-dep-version-range

Conversation

@nicoloesch

Copy link
Copy Markdown
Collaborator

Now that both this repo and its upstream dependencies enforce semver-by-label via cava-devops CI/CD (#28), MAJOR bumps only happen on an explicit breaking-labelled PR. Replaces exact pins with >=current,<next-major ranges:

  • oa-configurator==0.1.2>=0.1.2,<1.0.0
  • orm-loader==0.5.1>=0.5.2,<1.0.0 (also picks up orm-loader's already-released 0.5.2 patch)

Also adds .github/dependabot.yml (from cava-devops) and a lowest-direct resolution job in ci.yml.

Notes

CI on this PR will fail until cava-devops PR AustralianCancerDataNetwork/cava-devops#2 merges to main

  • ci.yml here already points at @main for the resolution input and the dependabot.yml template it depends on, neither of which exists on cava-devops main yet. Do not merge this PR until that one has merged.

@nicoloesch nicoloesch added the dependencies Dependency update. PATCH: x.y.z+1 label Jul 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependency update. PATCH: x.y.z+1

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Relax oa-configurator / orm-loader pins to semver ranges, verify via min-version CI + Dependabot

1 participant