| # Licensed to the Apache Software Foundation (ASF) under one |
| # or more contributor license agreements. See the NOTICE file |
| # distributed with this work for additional information |
| # regarding copyright ownership. The ASF licenses this file |
| # to you under the Apache License, Version 2.0 (the |
| # "License"); you may not use this file except in compliance |
| # with the License. You may obtain a copy of the License at |
| # |
| # http://www.apache.org/licenses/LICENSE-2.0 |
| # |
| # Unless required by applicable law or agreed to in writing, |
| # software distributed under the License is distributed on an |
| # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| # KIND, either express or implied. See the License for the |
| # specific language governing permissions and limitations |
| # under the License. |
| |
| # Version updates: every entry uses a single group covering ALL update |
| # types, so each ecosystem entry opens at most one version-update PR |
| # per cycle. Security updates bypass these groups and may still open |
| # individual PRs. |
| version: 2 |
| updates: |
| - package-ecosystem: "cargo" |
| directories: |
| - "/" |
| - "/foreign/cpp" |
| - "/foreign/python" |
| # TODO(hubcio): uncomment once #3235 is merged |
| # - "/foreign/php" |
| schedule: |
| interval: "weekly" |
| day: "monday" |
| rebase-strategy: "disabled" |
| open-pull-requests-limit: 3 |
| commit-message: |
| prefix: "chore(deps): " |
| reviewers: |
| - "apache/iggy-committers" |
| labels: |
| - "dependencies" |
| - "rust" |
| cooldown: |
| default-days: 7 |
| groups: |
| rust: |
| patterns: |
| - "*" |
| |
| - package-ecosystem: "github-actions" |
| directory: "/" |
| schedule: |
| interval: "weekly" |
| day: "tuesday" |
| rebase-strategy: "disabled" |
| open-pull-requests-limit: 3 |
| commit-message: |
| prefix: "chore(deps): " |
| reviewers: |
| - "apache/iggy-committers" |
| labels: |
| - "dependencies" |
| - "github-actions" |
| - "CI/CD" |
| cooldown: |
| default-days: 7 |
| groups: |
| github-actions: |
| patterns: |
| - "*" |
| |
| - package-ecosystem: "uv" |
| directories: |
| - "/foreign/python" |
| - "/bdd/python" |
| - "/examples/python" |
| schedule: |
| interval: "weekly" |
| day: "wednesday" |
| rebase-strategy: "disabled" |
| open-pull-requests-limit: 3 |
| commit-message: |
| prefix: "chore(deps): " |
| reviewers: |
| - "apache/iggy-committers" |
| labels: |
| - "dependencies" |
| - "python" |
| - "python:uv" |
| cooldown: |
| default-days: 7 |
| groups: |
| # Load-bearing for Python, not just tidiness: the three projects |
| # share apache-iggy via a path dependency, so each uv.lock embeds |
| # the SDK's requirement metadata. Majors escaped the previous |
| # minor-and-patch group as per-directory PRs that rewrote that |
| # embedded metadata without the manifest change it was derived |
| # from, and could never pass the lockfile check (see #3451). |
| python: |
| patterns: |
| - "*" |
| |
| - package-ecosystem: "npm" |
| directories: |
| - "/web" |
| schedule: |
| interval: "weekly" |
| day: "thursday" |
| rebase-strategy: "disabled" |
| open-pull-requests-limit: 3 |
| commit-message: |
| prefix: "chore(deps): " |
| reviewers: |
| - "apache/iggy-committers" |
| labels: |
| - "dependencies" |
| - "javascript" |
| cooldown: |
| default-days: 7 |
| groups: |
| web: |
| patterns: |
| - "*" |
| |
| - package-ecosystem: "npm" |
| directories: |
| - "/foreign/node" |
| - "/examples/node" |
| schedule: |
| interval: "weekly" |
| day: "thursday" |
| rebase-strategy: "disabled" |
| open-pull-requests-limit: 3 |
| commit-message: |
| prefix: "chore(deps): " |
| reviewers: |
| - "apache/iggy-committers" |
| labels: |
| - "dependencies" |
| - "javascript" |
| cooldown: |
| default-days: 7 |
| groups: |
| node: |
| patterns: |
| - "*" |
| |
| - package-ecosystem: "gomod" |
| directories: |
| - "/foreign/go" |
| - "/bdd/go" |
| - "/examples/go" |
| schedule: |
| interval: "weekly" |
| day: "friday" |
| rebase-strategy: "disabled" |
| open-pull-requests-limit: 3 |
| commit-message: |
| prefix: "chore(deps): " |
| reviewers: |
| - "apache/iggy-committers" |
| labels: |
| - "dependencies" |
| - "go" |
| cooldown: |
| default-days: 7 |
| groups: |
| go: |
| patterns: |
| - "*" |
| |
| - package-ecosystem: "nuget" |
| directories: |
| - "/foreign/csharp" |
| - "/examples/csharp" |
| schedule: |
| interval: "weekly" |
| day: "monday" |
| rebase-strategy: "disabled" |
| open-pull-requests-limit: 3 |
| commit-message: |
| prefix: "chore(deps): " |
| reviewers: |
| - "apache/iggy-committers" |
| labels: |
| - "dependencies" |
| - "csharp" |
| cooldown: |
| default-days: 7 |
| ignore: |
| - dependency-name: "System.IO.Hashing" |
| - dependency-name: "Microsoft.SourceLink.GitHub" |
| - dependency-name: "Microsoft.Extensions.Logging.Abstractions" |
| groups: |
| csharp: |
| patterns: |
| - "*" |
| |
| - package-ecosystem: "gradle" |
| directories: |
| - "/foreign/java" |
| - "/bdd/java" |
| - "/examples/java" |
| schedule: |
| interval: "weekly" |
| day: "tuesday" |
| rebase-strategy: "disabled" |
| open-pull-requests-limit: 3 |
| commit-message: |
| prefix: "chore(deps): " |
| reviewers: |
| - "apache/iggy-committers" |
| labels: |
| - "dependencies" |
| - "java" |
| cooldown: |
| default-days: 7 |
| ignore: |
| # examples/java wires iggy's own artifact to the local build via |
| # dependency substitution (settings.gradle.kts) behind a |
| # `local-dev` placeholder version. A Dependabot bump to a real |
| # release breaks example CI, which builds against the local tree. |
| - dependency-name: "org.apache.iggy:*" |
| groups: |
| java: |
| patterns: |
| - "*" |
| |
| - package-ecosystem: "docker" |
| directories: |
| - "/" |
| - "/core/server" |
| - "/core/server-ng" |
| - "/core/connectors/runtime" |
| - "/core/ai/mcp" |
| - "/core/bench/dashboard/server" |
| - "/web" |
| - "/bdd" |
| - "/bdd/csharp" |
| - "/bdd/go" |
| - "/bdd/java" |
| - "/bdd/node" |
| - "/bdd/python" |
| - "/bdd/rust" |
| - "/foreign/python" |
| - "/foreign/python/.devcontainer" |
| - "/foreign/java/external-processors/iggy-connector-flink/docker" |
| schedule: |
| interval: "weekly" |
| day: "wednesday" |
| rebase-strategy: "disabled" |
| open-pull-requests-limit: 3 |
| commit-message: |
| prefix: "chore(deps): " |
| reviewers: |
| - "apache/iggy-committers" |
| labels: |
| - "dependencies" |
| - "docker" |
| cooldown: |
| default-days: 7 |
| ignore: |
| # Docker dependency-name matching strips the registry prefix, so |
| # MCR images are named by repository path only. A |
| # `mcr.microsoft.com/...` form silently never matches and the bump |
| # leaks through (see closed PRs #3474, #3485). |
| # |
| # The Python interpreter version is pinned and synced across SDK |
| # files, CI, and Dockerfiles by |
| # scripts/ci/sync-python-interpreter-version.sh; a Dependabot bump |
| # of the base image alone would fail that check. |
| - dependency-name: "python" |
| - dependency-name: "devcontainers/python" |
| # Go and .NET toolchain base images are pinned deliberately to |
| # match the versions used across CI and the SDK builds. Bumping |
| # them is a manual decision, not Dependabot churn. |
| - dependency-name: "golang" |
| - dependency-name: "dotnet/sdk" |
| groups: |
| docker: |
| patterns: |
| - "*" |
| |
| - package-ecosystem: "bazel" |
| directory: "/foreign/cpp" |
| schedule: |
| interval: "weekly" |
| day: "thursday" |
| rebase-strategy: "disabled" |
| open-pull-requests-limit: 3 |
| commit-message: |
| prefix: "chore(deps): " |
| reviewers: |
| - "apache/iggy-committers" |
| labels: |
| - "dependencies" |
| - "cpp" |
| cooldown: |
| default-days: 7 |
| groups: |
| cpp: |
| patterns: |
| - "*" |
