Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Automatically Test and Update all Libraries to their Latest Version via Dependabot #504

Open
vjovanov opened this issue Jun 26, 2024 · 1 comment
Assignees
Labels
enhancement New feature or request

Comments

@vjovanov
Copy link
Member

All libraries are currently set for a specific version and never tested with later versions (e.g., netty). We apply those libraries in build tools then even if the user uses a newer library. This is not ideal because the metadata might not work with the latest version of a given library and it could lead to unexpected behavior.

We need to introduce a dependabot-based mechanism that will try metadata with all the latest library versions as they appear, and automatically bump the dependencies. If all the tests pass without a glitch, the list of supported versions is updated. If the tests fail the bot should open an issue on the metadata repository with the failure.

After this change, we should only use the meatadata for the libraries that are fully tested. If the library version is not supported the users should be notified that they can use a previous version of the library that is fully supported.

@vjovanov vjovanov added the enhancement New feature or request label Jun 26, 2024
@wilkinsona
Copy link
Contributor

users should be notified that they can use a previous version of the library that is fully supported

I think this should be worded carefully so as to avoid encouraging a user to downgrade a dependency and potentially expose their application to a security vulnerability.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

3 participants