Re: [PR] Add a cooldown period for dependabot [jena]

["afs (via GitHub)" <gi...@apache.org>]

afs commented on PR #3820:
URL: https://github.com/apache/jena/pull/3820#issuecomment-4168456804

   While there is no harm in adding a delay for non-security updates. Approved.
   
   Our biggest backlog is from `@cypress/code-coverage` and `@vue/eslint*` - both these cause dependencies on specific versions or old major versions so if their upstream has a fix, they block Fyseki UI getting the fix. Fortunately, it is usually on the "development" toolchain, not the deployment side.
   
   A different approach would be to update JS less frequently - monthly maybe? - this has the effect of a softer form of cooldown. The JS ecosystem generates PRs every week.
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: pr-unsubscribe@jena.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: pr-unsubscribe@jena.apache.org
For additional commands, e-mail: pr-help@jena.apache.org