mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
Alberto Schiabel
5e77e0de36
This PR:
- points Dependabot's `pip` ecosystem at `/`, where `pyproject.toml`
declares the uv workspace and `uv.lock` lives, instead of `/python` and
`/python/providers/*`
- fixes security bumps that never touched the lockfile: Dependabot's
langchain-openai bump in ec24c54ff edited only `python/pyproject.toml`,
and Dependabot alert 439 for that package is still open against a pin
that has been at 1.6.0 since 2026-08-24
- keeps explicit directories for the four providers that are not
workspace members (`autogen`, `claude_agent_sdk`, `langgraph`,
`llamaindex`) so they keep getting updates on their own manifests
- leaves the `tomli` and `ag2` ignores and the grouping untouched
Follow-up worth a look, out of scope here: `python/providers/openai` is
a workspace member but also carries its own `uv.lock`, which uv ignores
when it resolves the workspace from the root.
105 lines
3.8 KiB
YAML
105 lines
3.8 KiB
YAML
# Dependabot configuration.
|
|
# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
|
|
#
|
|
# Grouping keeps the update/security-alert volume manageable (one PR per group
|
|
# instead of one per advisory). Routine minor/patch bumps are batched; major
|
|
# bumps still arrive individually so they get review.
|
|
# Schedule: every Friday at 06:30 UTC / 12:00 IST.
|
|
|
|
version: 2
|
|
updates:
|
|
# TypeScript / npm workspace
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "friday"
|
|
time: "06:30"
|
|
open-pull-requests-limit: 10
|
|
# These majors are compatibility boundaries exercised by explicit test
|
|
# lanes. Upgrade them manually with parallel old/new coverage. Dependabot
|
|
# security updates are not affected by update-type ignores.
|
|
ignore:
|
|
- dependency-name: "ai"
|
|
update-types: ["version-update:semver-major"]
|
|
- dependency-name: "openai"
|
|
update-types: ["version-update:semver-major"]
|
|
# Node 22/24/25 built-in fetch uses the legacy dispatcher handler API.
|
|
- dependency-name: "undici"
|
|
update-types: ["version-update:semver-major"]
|
|
- dependency-name: "zod"
|
|
update-types: ["version-update:semver-major"]
|
|
# Version 1.0.0 is not compatible with the Effect package family in use.
|
|
- dependency-name: "@effect/printer-ansi"
|
|
versions: ["1.0.0"]
|
|
groups:
|
|
npm-production:
|
|
applies-to: version-updates
|
|
dependency-type: "production"
|
|
patterns: ["*"]
|
|
update-types: ["minor", "patch"]
|
|
npm-development:
|
|
applies-to: version-updates
|
|
dependency-type: "development"
|
|
patterns: ["*"]
|
|
update-types: ["minor", "patch"]
|
|
npm-security:
|
|
applies-to: security-updates
|
|
patterns: ["*"]
|
|
|
|
# Python SDK and provider packages.
|
|
#
|
|
# The uv workspace root is "/": that is where pyproject.toml declares
|
|
# [tool.uv.workspace] and where uv.lock lives, so Dependabot must run there
|
|
# to update the lockfile. Pointing it at "/python" only rewrote
|
|
# python/pyproject.toml and left uv.lock behind (see the langchain-openai
|
|
# security bump in ec24c54ff), and alerts against the lockfile never
|
|
# auto-resolved. The explicit provider directories are the projects that are
|
|
# not workspace members and resolve on their own.
|
|
- package-ecosystem: "pip"
|
|
directories:
|
|
- "/"
|
|
- "/python/providers/autogen"
|
|
- "/python/providers/claude_agent_sdk"
|
|
- "/python/providers/langgraph"
|
|
- "/python/providers/llamaindex"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "friday"
|
|
time: "06:30"
|
|
open-pull-requests-limit: 10
|
|
ignore:
|
|
# CrewAI 1.15.x requires Tomli 2.0.x. Keep patch and security updates,
|
|
# then remove this when CrewAI accepts a newer Tomli line.
|
|
- dependency-name: "tomli"
|
|
update-types:
|
|
- "version-update:semver-minor"
|
|
- "version-update:semver-major"
|
|
# ag2 1.0 dropped the top-level `autogen` package that
|
|
# composio-autogen imports (`autogen.agentchat.register_function`,
|
|
# `ConversableAgent`); the 1.x wheel ships only `ag2`. Adopting it is a
|
|
# provider rewrite, not a requirement widening. Remove this once
|
|
# composio-autogen targets the `ag2` namespace.
|
|
- dependency-name: "ag2"
|
|
update-types:
|
|
- "version-update:semver-major"
|
|
groups:
|
|
pip-version:
|
|
applies-to: version-updates
|
|
patterns: ["*"]
|
|
update-types: ["minor", "patch"]
|
|
pip-security:
|
|
applies-to: security-updates
|
|
patterns: ["*"]
|
|
|
|
# GitHub Actions workflow pins
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "friday"
|
|
time: "06:30"
|
|
groups:
|
|
github-actions:
|
|
patterns: ["*"]
|