From 6bd84346580662eb6f1144fc8ed730409b1ec185 Mon Sep 17 00:00:00 2001 From: Jakub Bartkowiak Date: Thu, 2 Jul 2026 23:57:11 +0200 Subject: [PATCH] ci: ignore major bumps for runtime deps in Dependabot Keep the library's runtime dependency floors low so consumers aren't forced onto a new major of Microsoft.Extensions.Logging(.Abstractions) or System.IO.Ports. Minor/patch updates are still proposed; majors are taken deliberately. MinVer is intentionally not ignored so its major bump can still be reviewed and taken after 4.0 ships. --- .github/dependabot.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 94d594b2..30a4b370 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,6 +6,18 @@ updates: schedule: interval: "weekly" open-pull-requests-limit: 10 + ignore: + # Keep the library's runtime dependency floors low: a library forcing a new major of these + # ubiquitous packages would push that major onto every consumer's graph. Take majors here + # deliberately, not automatically (minor/patch updates are still proposed). + - dependency-name: "Microsoft.Extensions.Logging" + update-types: ["version-update:semver-major"] + - dependency-name: "Microsoft.Extensions.Logging.Abstractions" + update-types: ["version-update:semver-major"] + # System.IO.Ports is pinned per-TFM to match the runtime major (net8 -> 8.x, net10 -> 10.x); + # a cross-major bump on the net8 pin would force .NET 8 consumers onto System.IO.Ports 10.x. + - dependency-name: "System.IO.Ports" + update-types: ["version-update:semver-major"] # GitHub Actions used by the build/release workflows. - package-ecosystem: "github-actions"