You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@commons.apache.org by en...@apache.org on 2025/02/10 08:44:31 UTC
(commons-math) branch master updated: Update changes.xml
This is an automated email from the ASF dual-hosted git repository.
engelen pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-math.git
The following commit(s) were added to refs/heads/master by this push:
new aa1efd86a Update changes.xml
aa1efd86a is described below
commit aa1efd86a6ab5f229a3b579db16191d8e9672bf5
Author: Arnout Engelen <ar...@bzzt.net>
AuthorDate: Mon Feb 10 09:44:16 2025 +0100
Update changes.xml
---
src/changes/changes.xml | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index bcd88487e..887ba868c 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -96,6 +96,7 @@ Caveat:
to support the whole codebase (it was one of the main reasons for
creating more focused components).
">
+ <action dev="engelen" type="update" due-to="Dependabot">Bump org.apache.commons:commons-rng-bom from 1.5 to 1.6 #244</action>
<action dev="erans" type="update" issue="MATH-1669" due-to="Wolff Bock von Wuelfingen">
Javadoc: Fix broken link.
</action>
Re: [All] Useless update of "changes.xml"
Posted by Xeno Amess <xe...@gmail.com>.
> +1, otherwise we may also thank Git, IntelliJ and OpenJDK for every
release :)
git yes.
jdk half half because I also donated my time for it(though not very much hours).
for jetbrains, no, I paid already.
Xeno Amess
________________________________
From: Emmanuel Bourg <eb...@apache.org>
Sent: Monday, February 10, 2025 6:32:35 PM
To: dev@commons.apache.org <de...@commons.apache.org>
Subject: Re: [All] Useless update of "changes.xml"
On 10/02/2025 10:20, Gilles Sadowski wrote:
> Hi.
>
> The commit below will generate a line in the release notes that says
> "Thanks to Dependabot".
> I don't that it is useful (IMHO, it is even harmful if it is littered
> with hardly
> informative automated messages that drown functional changes).
> Fine if there is an easy and safe way to update a dependency, but
> should we thank a robot?
+1, otherwise we may also thank Git, IntelliJ and OpenJDK for every
release :)
Emmanuel Bourg
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: [All] Useless update of "changes.xml"
Posted by Gary Gregory <ga...@gmail.com>.
Hello Xeno,
Please start a new thread with your proposal.
Gary
On Mon, Feb 10, 2025, 08:10 Xeno Amess <xe...@gmail.com> wrote:
> btw I just got an idea, is it meaningful to make a commons-bom or
> something?
> I really worried about if our repos can even runs in a same jvm(I mean
> normally, not osgi or shading)
> Maybe a commons-bom repo and monthly release be useful? Gary what do you
> think?
>
> Xeno Amess <xe...@gmail.com> 于2025年2月10日周一 21:08写道：
>
> > > This is different Emanuel, Dependabot did in fact do all the work. I
> > don't
> > think we would suggest not giving authorship if a person did the work.
> That
> > work is extremely valuable IMO, especially considering the OS x Java
> > version matrix.
> >
> > Gary, root of the problem is as I described before, you and Gilles have
> > different idea for the work of dependabot.
> > You think its work is meaningful, he think its work be not only non
> > meaningful but even negative.
> > IMO Gilles knows a bot who did great positive work shall be thankful, but
> > he just don't think dependabot worth it...
> > sigh, apache commons are not that common in all ideas.
> >
> > Gary Gregory <ga...@gmail.com> 于2025年2月10日周一 20:34写道：
> >
> >> This is different Emanuel, Dependabot did in fact do all the work. I
> don't
> >> think we would suggest not giving authorship if a person did the work.
> >> That
> >> work is extremely valuable IMO, especially considering the OS x Java
> >> version matrix.
> >>
> >> Gary
> >>
> >> On Mon, Feb 10, 2025, 05:34 Emmanuel Bourg <eb...@apache.org> wrote:
> >>
> >> > On 10/02/2025 10:20, Gilles Sadowski wrote:
> >> > > Hi.
> >> > >
> >> > > The commit below will generate a line in the release notes that says
> >> > > "Thanks to Dependabot".
> >> > > I don't that it is useful (IMHO, it is even harmful if it is
> littered
> >> > > with hardly
> >> > > informative automated messages that drown functional changes).
> >> > > Fine if there is an easy and safe way to update a dependency, but
> >> > > should we thank a robot?
> >> >
> >> > +1, otherwise we may also thank Git, IntelliJ and OpenJDK for every
> >> > release :)
> >> >
> >> > Emmanuel Bourg
> >> >
> >> > ---------------------------------------------------------------------
> >> > To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> >> > For additional commands, e-mail: dev-help@commons.apache.org
> >> >
> >> >
> >>
> >
>
Re: [All] Useless update of "changes.xml"
Posted by Xeno Amess <xe...@gmail.com>.
btw I just got an idea, is it meaningful to make a commons-bom or something?
I really worried about if our repos can even runs in a same jvm(I mean
normally, not osgi or shading)
Maybe a commons-bom repo and monthly release be useful? Gary what do you
think?
Xeno Amess <xe...@gmail.com> 于2025年2月10日周一 21:08写道：
> > This is different Emanuel, Dependabot did in fact do all the work. I
> don't
> think we would suggest not giving authorship if a person did the work. That
> work is extremely valuable IMO, especially considering the OS x Java
> version matrix.
>
> Gary, root of the problem is as I described before, you and Gilles have
> different idea for the work of dependabot.
> You think its work is meaningful, he think its work be not only non
> meaningful but even negative.
> IMO Gilles knows a bot who did great positive work shall be thankful, but
> he just don't think dependabot worth it...
> sigh, apache commons are not that common in all ideas.
>
> Gary Gregory <ga...@gmail.com> 于2025年2月10日周一 20:34写道：
>
>> This is different Emanuel, Dependabot did in fact do all the work. I don't
>> think we would suggest not giving authorship if a person did the work.
>> That
>> work is extremely valuable IMO, especially considering the OS x Java
>> version matrix.
>>
>> Gary
>>
>> On Mon, Feb 10, 2025, 05:34 Emmanuel Bourg <eb...@apache.org> wrote:
>>
>> > On 10/02/2025 10:20, Gilles Sadowski wrote:
>> > > Hi.
>> > >
>> > > The commit below will generate a line in the release notes that says
>> > > "Thanks to Dependabot".
>> > > I don't that it is useful (IMHO, it is even harmful if it is littered
>> > > with hardly
>> > > informative automated messages that drown functional changes).
>> > > Fine if there is an easy and safe way to update a dependency, but
>> > > should we thank a robot?
>> >
>> > +1, otherwise we may also thank Git, IntelliJ and OpenJDK for every
>> > release :)
>> >
>> > Emmanuel Bourg
>> >
>> > ---------------------------------------------------------------------
>> > To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
>> > For additional commands, e-mail: dev-help@commons.apache.org
>> >
>> >
>>
>
Re: [All] Useless update of "changes.xml"
Posted by Xeno Amess <xe...@gmail.com>.
> This is different Emanuel, Dependabot did in fact do all the work. I don't
think we would suggest not giving authorship if a person did the work. That
work is extremely valuable IMO, especially considering the OS x Java
version matrix.
Gary, root of the problem is as I described before, you and Gilles have
different idea for the work of dependabot.
You think its work is meaningful, he think its work be not only non
meaningful but even negative.
IMO Gilles knows a bot who did great positive work shall be thankful, but
he just don't think dependabot worth it...
sigh, apache commons are not that common in all ideas.
Gary Gregory <ga...@gmail.com> 于2025年2月10日周一 20:34写道：
> This is different Emanuel, Dependabot did in fact do all the work. I don't
> think we would suggest not giving authorship if a person did the work. That
> work is extremely valuable IMO, especially considering the OS x Java
> version matrix.
>
> Gary
>
> On Mon, Feb 10, 2025, 05:34 Emmanuel Bourg <eb...@apache.org> wrote:
>
> > On 10/02/2025 10:20, Gilles Sadowski wrote:
> > > Hi.
> > >
> > > The commit below will generate a line in the release notes that says
> > > "Thanks to Dependabot".
> > > I don't that it is useful (IMHO, it is even harmful if it is littered
> > > with hardly
> > > informative automated messages that drown functional changes).
> > > Fine if there is an easy and safe way to update a dependency, but
> > > should we thank a robot?
> >
> > +1, otherwise we may also thank Git, IntelliJ and OpenJDK for every
> > release :)
> >
> > Emmanuel Bourg
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> > For additional commands, e-mail: dev-help@commons.apache.org
> >
> >
>
Re: [All] Useless update of "changes.xml"
Posted by Gary Gregory <ga...@gmail.com>.
This is different Emanuel, Dependabot did in fact do all the work. I don't
think we would suggest not giving authorship if a person did the work. That
work is extremely valuable IMO, especially considering the OS x Java
version matrix.
Gary
On Mon, Feb 10, 2025, 05:34 Emmanuel Bourg <eb...@apache.org> wrote:
> On 10/02/2025 10:20, Gilles Sadowski wrote:
> > Hi.
> >
> > The commit below will generate a line in the release notes that says
> > "Thanks to Dependabot".
> > I don't that it is useful (IMHO, it is even harmful if it is littered
> > with hardly
> > informative automated messages that drown functional changes).
> > Fine if there is an easy and safe way to update a dependency, but
> > should we thank a robot?
>
> +1, otherwise we may also thank Git, IntelliJ and OpenJDK for every
> release :)
>
> Emmanuel Bourg
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
>
Re: [All] Useless update of "changes.xml"
Posted by Emmanuel Bourg <eb...@apache.org>.
On 10/02/2025 10:20, Gilles Sadowski wrote:
> Hi.
>
> The commit below will generate a line in the release notes that says
> "Thanks to Dependabot".
> I don't that it is useful (IMHO, it is even harmful if it is littered
> with hardly
> informative automated messages that drown functional changes).
> Fine if there is an easy and safe way to update a dependency, but
> should we thank a robot?
+1, otherwise we may also thank Git, IntelliJ and OpenJDK for every
release :)
Emmanuel Bourg
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: [All] Useless update of "changes.xml"
Posted by Gary Gregory <ga...@gmail.com>.
Knowing that Dependabot did the work should tell you that all builds were
green in the GH CI matrix (unless one commits a bump when a red build
exists in the matrix, it's happened before).
The alternative is that you have no idea what a dev did to validate an
upgrade (unless the commit comment says so).
I think that getting this information is better that not and also shows
that we are using a potent infrastructure tool as opposed to "it worked on
my setup".
Gary
On Mon, Feb 10, 2025, 04:21 Gilles Sadowski <gi...@gmail.com> wrote:
> Hi.
>
> The commit below will generate a line in the release notes that says
> "Thanks to Dependabot".
> I don't that it is useful (IMHO, it is even harmful if it is littered
> with hardly
> informative automated messages that drown functional changes).
> Fine if there is an easy and safe way to update a dependency, but
> should we thank a robot?
>
> Regards,
> Gilles
>
> Le lun. 10 févr. 2025 à 09:45, <en...@apache.org> a écrit :
> >
> > This is an automated email from the ASF dual-hosted git repository.
> >
> > engelen pushed a commit to branch master
> > in repository https://gitbox.apache.org/repos/asf/commons-math.git
> >
> >
> > The following commit(s) were added to refs/heads/master by this push:
> > new aa1efd86a Update changes.xml
> > aa1efd86a is described below
> >
> > commit aa1efd86a6ab5f229a3b579db16191d8e9672bf5
> > Author: Arnout Engelen <ar...@bzzt.net>
> > AuthorDate: Mon Feb 10 09:44:16 2025 +0100
> >
> > Update changes.xml
> > ---
> > src/changes/changes.xml | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/src/changes/changes.xml b/src/changes/changes.xml
> > index bcd88487e..887ba868c 100644
> > --- a/src/changes/changes.xml
> > +++ b/src/changes/changes.xml
> > @@ -96,6 +96,7 @@ Caveat:
> > to support the whole codebase (it was one of the main reasons for
> > creating more focused components).
> > ">
> > + <action dev="engelen" type="update" due-to="Dependabot">Bump
> org.apache.commons:commons-rng-bom from 1.5 to 1.6 #244</action>
> > <action dev="erans" type="update" issue="MATH-1669" due-to="Wolff
> Bock von Wuelfingen">
> > Javadoc: Fix broken link.
> > </action>
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
>
Re: [All] Useless update of "changes.xml"
Posted by Gilles Sadowski <gi...@gmail.com>.
Hi Arnout and all.
Le lun. 10 févr. 2025 à 12:11, Arnout Engelen <en...@apache.org> a écrit :
>
> On Mon, Feb 10, 2025 at 11:45 AM Gilles Sadowski <gi...@gmail.com>
> wrote:
>
> > Le lun. 10 févr. 2025 à 11:25, Arnout Engelen <en...@apache.org> a
> > écrit :
> > > Do you mean we should leave out the whole line or just the "Thanks to
> > > Dependabot" part?
> >
> > The whole line.
> >
> > > I tried to follow the convention from other Commons projects where each
> > > dependency update gets such a line in the changelog.
> >
> > Well, the "convention" in math-related components was to follow the
> > previous convention. ;-) Which was to do such dependency updates
> > when deemed necessary (by a human), usually at the latest before a
> > release.
> >
> > > I don't mind the lines
> > > in the change log too much (it seems useful to see what got updated,
> > > especially when we group update lines in the log).
> >
> > Information is useful; such updates "inter-releases" is not IMHO.
> >
> > As it stands, I prefer to not rely on Dependabot to do the change; the
> > useful part of that tool is to make checks, and "say" that it would be
> > harmless to update.
> >
>
> Gotcha, I didn't realize different commons- components had different ways
> of working here, sorry about that.
No need to; it's great that you'd care for all components. :-)
> So for commons-math, you'd prefer Dependabot PRs to be created but not
> merged (or at least not during regular development), right? Shall I
> configure a '[not for merge]' prefix (
> https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/customizing-dependabot-prs#adding-a-prefix-to-commit-messages)
> for the generated commit/PR titles? Otherwise I'm sure I'll forget and run
> afoul of this again :).
Not sure about this. [From the get go, I'm GH averse (reasons
not TBD here.]
To indirectly answer everyone who gave their (rightful) opinions
about why they do what they do, my take is the following, for the
components for which I (or lately Alex) do the RM work:
* dependencies are upgraded when deemed appropriate by a
real developer[1], not a robot, or
* dependencies are upgraded to the latest (and only supported)
version of the component in question, as preparation for the
release.
Regards,
Gilles
[1] Who is involved in the ongoing work of modularizing Commons
Math (which is how the dependencies in question have come about).
It is a (good) side-effect of the modularization initiative that more
automation is possible, but what I actually mean is that whenever
any math-related component is released, a post-release task
_should_ be performed: upgrade all other math-related components
that depend on it. Sometimes this is forgotten. Sorry about that.
And Gary will be right to say that it's what "Dependabot" is for... ;-)
So indeed, I'd prefer a "reminder" (automated or not), in case we
forgot that post-release step (that should be considered mandatory
in the math-related components "ecosystem"). Also, that step _must_
be trivial because one of the pre-release step should be to ensure
that the newest release does not unintentionally break any of its
dependents (and if it does it intentionally, then corresponding JIRA
tickets must be filed in each dependent's project).
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: [All] Useless update of "changes.xml"
Posted by Xeno Amess <xe...@gmail.com>.
> Gotcha, I didn't realize different commons- components had different ways
of working here, sorry about that.
yes. Gillis tends to remain on old versions of dependencies, and worries
about people using old versions dependency cannot upgrade to new versions
of commons-lib.
so Gillis and math libs nearly refuse all dependabot updates.
Gary on the other hand, tends to use as new as possible dependencies for
features, refines, performance, safety-patch, and cares more for users who
use the latest dependencies too.
There have been several discussions before, but as both ways, you see, are
somehow reasonable, and none of them are nonsense, so there be actually no
common way to solve it.
Arnout Engelen <en...@apache.org> 于2025年2月10日周一 19:11写道：
> On Mon, Feb 10, 2025 at 11:45 AM Gilles Sadowski <gi...@gmail.com>
> wrote:
>
> > Le lun. 10 févr. 2025 à 11:25, Arnout Engelen <en...@apache.org> a
> > écrit :
> > > Do you mean we should leave out the whole line or just the "Thanks to
> > > Dependabot" part?
> >
> > The whole line.
> >
> > > I tried to follow the convention from other Commons projects where each
> > > dependency update gets such a line in the changelog.
> >
> > Well, the "convention" in math-related components was to follow the
> > previous convention. ;-) Which was to do such dependency updates
> > when deemed necessary (by a human), usually at the latest before a
> > release.
> >
> > > I don't mind the lines
> > > in the change log too much (it seems useful to see what got updated,
> > > especially when we group update lines in the log).
> >
> > Information is useful; such updates "inter-releases" is not IMHO.
> >
> > As it stands, I prefer to not rely on Dependabot to do the change; the
> > useful part of that tool is to make checks, and "say" that it would be
> > harmless to update.
> >
>
> Gotcha, I didn't realize different commons- components had different ways
> of working here, sorry about that.
>
> So for commons-math, you'd prefer Dependabot PRs to be created but not
> merged (or at least not during regular development), right? Shall I
> configure a '[not for merge]' prefix (
>
> https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/customizing-dependabot-prs#adding-a-prefix-to-commit-messages
> )
> for the generated commit/PR titles? Otherwise I'm sure I'll forget and run
> afoul of this again :).
>
>
> Kind regards,
>
> --
> Arnout Engelen
> ASF Security Response
> Apache Pekko PMC member, ASF Member
> NixOS Committer
> Independent Open Source consultant
>
Re: [All] Useless update of "changes.xml"
Posted by Arnout Engelen <en...@apache.org>.
On Mon, Feb 10, 2025 at 11:45 AM Gilles Sadowski <gi...@gmail.com>
wrote:
> Le lun. 10 févr. 2025 à 11:25, Arnout Engelen <en...@apache.org> a
> écrit :
> > Do you mean we should leave out the whole line or just the "Thanks to
> > Dependabot" part?
>
> The whole line.
>
> > I tried to follow the convention from other Commons projects where each
> > dependency update gets such a line in the changelog.
>
> Well, the "convention" in math-related components was to follow the
> previous convention. ;-) Which was to do such dependency updates
> when deemed necessary (by a human), usually at the latest before a
> release.
>
> > I don't mind the lines
> > in the change log too much (it seems useful to see what got updated,
> > especially when we group update lines in the log).
>
> Information is useful; such updates "inter-releases" is not IMHO.
>
> As it stands, I prefer to not rely on Dependabot to do the change; the
> useful part of that tool is to make checks, and "say" that it would be
> harmless to update.
>
Gotcha, I didn't realize different commons- components had different ways
of working here, sorry about that.
So for commons-math, you'd prefer Dependabot PRs to be created but not
merged (or at least not during regular development), right? Shall I
configure a '[not for merge]' prefix (
https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/customizing-dependabot-prs#adding-a-prefix-to-commit-messages)
for the generated commit/PR titles? Otherwise I'm sure I'll forget and run
afoul of this again :).
Kind regards,
--
Arnout Engelen
ASF Security Response
Apache Pekko PMC member, ASF Member
NixOS Committer
Independent Open Source consultant
Re: [All] Useless update of "changes.xml"
Posted by Xeno Amess <xe...@gmail.com>.
> > I don't that it is useful (IMHO, it is even harmful if it is littered
> > with hardly
> > informative automated messages that drown functional changes).
> > Fine if there is an easy and safe way to update a dependency, but
> > should we thank a robot?
> >
>
> Do you mean we should leave out the whole line or just the "Thanks to
> Dependabot" part?
> The whole line.
oh now I get what you mean...yes non-primary message shall not appear in release note I agree.otherwise message overflow.
bc breaking dependency updates are another situation.
Xeno Amess
________________________________
From: Gilles Sadowski <gi...@gmail.com>
Sent: Monday, February 10, 2025 6:45:06 PM
To: Commons Developers List <de...@commons.apache.org>
Subject: Re: [All] Useless update of "changes.xml"
Hi.
Le lun. 10 févr. 2025 à 11:25, Arnout Engelen <en...@apache.org> a écrit :
>
> On Mon, Feb 10, 2025 at 10:21 AM Gilles Sadowski <gi...@gmail.com>
> wrote:
>
> > The commit below will generate a line in the release notes that says
> > "Thanks to Dependabot".
> >
>
> It generates a line that says "Bump org.apache.commons:commons-rng-bom from
> 1.5 to 1.6 #244 Thanks to Dependabot.".
I know (that's what I meant above). The point it is that it is not something
I consider should appear in the changelog.
When we did/do it "manually", it was a change in the "pom.xml" that would
appear in the CVS commit log. In most releases now , the self-promotion
of Dependabot obscures the true changes.
> > I don't that it is useful (IMHO, it is even harmful if it is littered
> > with hardly
> > informative automated messages that drown functional changes).
> > Fine if there is an easy and safe way to update a dependency, but
> > should we thank a robot?
> >
>
> Do you mean we should leave out the whole line or just the "Thanks to
> Dependabot" part?
The whole line.
>
> I tried to follow the convention from other Commons projects where each
> dependency update gets such a line in the changelog.
Well, the "convention" in math-related components was to follow the
previous convention. ;-) Which was to do such dependency updates
when deemed necessary (by a human), usually at the latest before a
release.
> I don't mind the lines
> in the change log too much (it seems useful to see what got updated,
> especially when we group update lines in the log).
Information is useful; such updates "inter-releases" is not IMHO.
> On the other hand, I do
> think it's cumbersome that I can't simply merge a dependabot PR, but have
> to go in and update changes.xml. That doesn't seem easy to automate,
> though, and I'd say we don't want to add additional steps to the release
> process either.
Sure. I didn't suggest anything of the like.
As it stands, I prefer to not rely on Dependabot to do the change; the
useful part of that tool is to make checks, and "say" that it would be
harmless to update.
Regards,
Gilles
>> [...]
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: [All] Useless update of "changes.xml"
Posted by Gilles Sadowski <gi...@gmail.com>.
Hi.
Le lun. 10 févr. 2025 à 11:25, Arnout Engelen <en...@apache.org> a écrit :
>
> On Mon, Feb 10, 2025 at 10:21 AM Gilles Sadowski <gi...@gmail.com>
> wrote:
>
> > The commit below will generate a line in the release notes that says
> > "Thanks to Dependabot".
> >
>
> It generates a line that says "Bump org.apache.commons:commons-rng-bom from
> 1.5 to 1.6 #244 Thanks to Dependabot.".
I know (that's what I meant above). The point it is that it is not something
I consider should appear in the changelog.
When we did/do it "manually", it was a change in the "pom.xml" that would
appear in the CVS commit log. In most releases now , the self-promotion
of Dependabot obscures the true changes.
> > I don't that it is useful (IMHO, it is even harmful if it is littered
> > with hardly
> > informative automated messages that drown functional changes).
> > Fine if there is an easy and safe way to update a dependency, but
> > should we thank a robot?
> >
>
> Do you mean we should leave out the whole line or just the "Thanks to
> Dependabot" part?
The whole line.
>
> I tried to follow the convention from other Commons projects where each
> dependency update gets such a line in the changelog.
Well, the "convention" in math-related components was to follow the
previous convention. ;-) Which was to do such dependency updates
when deemed necessary (by a human), usually at the latest before a
release.
> I don't mind the lines
> in the change log too much (it seems useful to see what got updated,
> especially when we group update lines in the log).
Information is useful; such updates "inter-releases" is not IMHO.
> On the other hand, I do
> think it's cumbersome that I can't simply merge a dependabot PR, but have
> to go in and update changes.xml. That doesn't seem easy to automate,
> though, and I'd say we don't want to add additional steps to the release
> process either.
Sure. I didn't suggest anything of the like.
As it stands, I prefer to not rely on Dependabot to do the change; the
useful part of that tool is to make checks, and "say" that it would be
harmless to update.
Regards,
Gilles
>> [...]
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: [All] Useless update of "changes.xml"
Posted by "Piotr P. Karwasz" <pi...@mailing.copernik.eu>.
Hi Arnout,
On 10.02.2025 11:24, Arnout Engelen wrote:
> That doesn't seem easy to automate,
> though, and I'd say we don't want to add additional steps to the release
> process either.
It is possible to automate (see [1] for example), but it requires a
workflow to run as `pull-request-target`. Alternatively we can do add
the entry automatically once the Dependabot PR has been merged, which
requires a bot to push commits to the main branch automatically.
There is no ideal solution as far as I know.
Piotr
[1]
https://github.com/apache/logging-parent/blob/main/.github/workflows/merge-dependabot-reusable.yaml
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: [All] Useless update of "changes.xml"
Posted by Gary Gregory <ga...@gmail.com>.
I think the idea of "celebration" is antiquated here, I see this as a label
that reflects the same idea that git has with the split of "author" and
"committer". In this case "dev" is the committer and "thanks" is the author.
Gary
On Mon, Feb 10, 2025, 05:25 Arnout Engelen <en...@apache.org> wrote:
> On Mon, Feb 10, 2025 at 10:21 AM Gilles Sadowski <gi...@gmail.com>
> wrote:
>
> > The commit below will generate a line in the release notes that says
> > "Thanks to Dependabot".
> >
>
> It generates a line that says "Bump org.apache.commons:commons-rng-bom from
> 1.5 to 1.6 #244 Thanks to Dependabot.".
>
>
> > I don't that it is useful (IMHO, it is even harmful if it is littered
> > with hardly
> > informative automated messages that drown functional changes).
> > Fine if there is an easy and safe way to update a dependency, but
> > should we thank a robot?
> >
>
> Do you mean we should leave out the whole line or just the "Thanks to
> Dependabot" part?
>
> I tried to follow the convention from other Commons projects where each
> dependency update gets such a line in the changelog. I don't mind the lines
> in the change log too much (it seems useful to see what got updated,
> especially when we group update lines in the log). On the other hand, I do
> think it's cumbersome that I can't simply merge a dependabot PR, but have
> to go in and update changes.xml. That doesn't seem easy to automate,
> though, and I'd say we don't want to add additional steps to the release
> process either.
>
>
> Kind regards,
>
> Arnout
>
>
> >
> > Le lun. 10 févr. 2025 à 09:45, <en...@apache.org> a écrit :
> > >
> > > This is an automated email from the ASF dual-hosted git repository.
> > >
> > > engelen pushed a commit to branch master
> > > in repository https://gitbox.apache.org/repos/asf/commons-math.git
> > >
> > >
> > > The following commit(s) were added to refs/heads/master by this push:
> > > new aa1efd86a Update changes.xml
> > > aa1efd86a is described below
> > >
> > > commit aa1efd86a6ab5f229a3b579db16191d8e9672bf5
> > > Author: Arnout Engelen <ar...@bzzt.net>
> > > AuthorDate: Mon Feb 10 09:44:16 2025 +0100
> > >
> > > Update changes.xml
> > > ---
> > > src/changes/changes.xml | 1 +
> > > 1 file changed, 1 insertion(+)
> > >
> > > diff --git a/src/changes/changes.xml b/src/changes/changes.xml
> > > index bcd88487e..887ba868c 100644
> > > --- a/src/changes/changes.xml
> > > +++ b/src/changes/changes.xml
> > > @@ -96,6 +96,7 @@ Caveat:
> > > to support the whole codebase (it was one of the main reasons for
> > > creating more focused components).
> > > ">
> > > + <action dev="engelen" type="update" due-to="Dependabot">Bump
> > org.apache.commons:commons-rng-bom from 1.5 to 1.6 #244</action>
> > > <action dev="erans" type="update" issue="MATH-1669"
> due-to="Wolff
> > Bock von Wuelfingen">
> > > Javadoc: Fix broken link.
> > > </action>
> > >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> > For additional commands, e-mail: dev-help@commons.apache.org
> >
> >
>
> --
> Arnout Engelen
> ASF Security Response
> Apache Pekko PMC member, ASF Member
> NixOS Committer
> Independent Open Source consultant
>
Re: [All] Useless update of "changes.xml"
Posted by Arnout Engelen <en...@apache.org>.
On Mon, Feb 10, 2025 at 10:21 AM Gilles Sadowski <gi...@gmail.com>
wrote:
> The commit below will generate a line in the release notes that says
> "Thanks to Dependabot".
>
It generates a line that says "Bump org.apache.commons:commons-rng-bom from
1.5 to 1.6 #244 Thanks to Dependabot.".
> I don't that it is useful (IMHO, it is even harmful if it is littered
> with hardly
> informative automated messages that drown functional changes).
> Fine if there is an easy and safe way to update a dependency, but
> should we thank a robot?
>
Do you mean we should leave out the whole line or just the "Thanks to
Dependabot" part?
I tried to follow the convention from other Commons projects where each
dependency update gets such a line in the changelog. I don't mind the lines
in the change log too much (it seems useful to see what got updated,
especially when we group update lines in the log). On the other hand, I do
think it's cumbersome that I can't simply merge a dependabot PR, but have
to go in and update changes.xml. That doesn't seem easy to automate,
though, and I'd say we don't want to add additional steps to the release
process either.
Kind regards,
Arnout
>
> Le lun. 10 févr. 2025 à 09:45, <en...@apache.org> a écrit :
> >
> > This is an automated email from the ASF dual-hosted git repository.
> >
> > engelen pushed a commit to branch master
> > in repository https://gitbox.apache.org/repos/asf/commons-math.git
> >
> >
> > The following commit(s) were added to refs/heads/master by this push:
> > new aa1efd86a Update changes.xml
> > aa1efd86a is described below
> >
> > commit aa1efd86a6ab5f229a3b579db16191d8e9672bf5
> > Author: Arnout Engelen <ar...@bzzt.net>
> > AuthorDate: Mon Feb 10 09:44:16 2025 +0100
> >
> > Update changes.xml
> > ---
> > src/changes/changes.xml | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/src/changes/changes.xml b/src/changes/changes.xml
> > index bcd88487e..887ba868c 100644
> > --- a/src/changes/changes.xml
> > +++ b/src/changes/changes.xml
> > @@ -96,6 +96,7 @@ Caveat:
> > to support the whole codebase (it was one of the main reasons for
> > creating more focused components).
> > ">
> > + <action dev="engelen" type="update" due-to="Dependabot">Bump
> org.apache.commons:commons-rng-bom from 1.5 to 1.6 #244</action>
> > <action dev="erans" type="update" issue="MATH-1669" due-to="Wolff
> Bock von Wuelfingen">
> > Javadoc: Fix broken link.
> > </action>
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
>
--
Arnout Engelen
ASF Security Response
Apache Pekko PMC member, ASF Member
NixOS Committer
Independent Open Source consultant
Re: [All] Useless update of "changes.xml"
Posted by Xeno Amess <xe...@gmail.com>.
btw I bet Gary would say yes to the thank, he really loves that bot lol
Xeno Amess <xe...@gmail.com> 于2025年2月10日周一 17:31写道：
> thank is free imo...
> a free thank for a free bot, sounds fair to me...
>
> Xeno Amess
> ------------------------------
> *From:* Gilles Sadowski <gi...@gmail.com>
> *Sent:* Monday, February 10, 2025 5:20:53 PM
> *To:* Commons Developers List <de...@commons.apache.org>
> *Subject:* [All] Useless update of "changes.xml"
>
> Hi.
>
> The commit below will generate a line in the release notes that says
> "Thanks to Dependabot".
> I don't that it is useful (IMHO, it is even harmful if it is littered
> with hardly
> informative automated messages that drown functional changes).
> Fine if there is an easy and safe way to update a dependency, but
> should we thank a robot?
>
> Regards,
> Gilles
>
> Le lun. 10 févr. 2025 à 09:45, <en...@apache.org> a écrit :
> >
> > This is an automated email from the ASF dual-hosted git repository.
> >
> > engelen pushed a commit to branch master
> > in repository https://gitbox.apache.org/repos/asf/commons-math.git
> >
> >
> > The following commit(s) were added to refs/heads/master by this push:
> > new aa1efd86a Update changes.xml
> > aa1efd86a is described below
> >
> > commit aa1efd86a6ab5f229a3b579db16191d8e9672bf5
> > Author: Arnout Engelen <ar...@bzzt.net>
> > AuthorDate: Mon Feb 10 09:44:16 2025 +0100
> >
> > Update changes.xml
> > ---
> > src/changes/changes.xml | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/src/changes/changes.xml b/src/changes/changes.xml
> > index bcd88487e..887ba868c 100644
> > --- a/src/changes/changes.xml
> > +++ b/src/changes/changes.xml
> > @@ -96,6 +96,7 @@ Caveat:
> > to support the whole codebase (it was one of the main reasons for
> > creating more focused components).
> > ">
> > + <action dev="engelen" type="update" due-to="Dependabot">Bump
> org.apache.commons:commons-rng-bom from 1.5 to 1.6 #244</action>
> > <action dev="erans" type="update" issue="MATH-1669" due-to="Wolff
> Bock von Wuelfingen">
> > Javadoc: Fix broken link.
> > </action>
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
>
Re: [All] Useless update of "changes.xml"
Posted by Gilles Sadowski <gi...@gmail.com>.
Le lun. 10 févr. 2025 à 10:31, Xeno Amess <xe...@gmail.com> a écrit :
>
> thank is free imo...
It's not when it actually obscures the information.
> a free thank for a free bot, sounds fair to me...
It's not "fair" wrt all the other much more useful tools that we use to build
our software but is not celebrated each time we call it (the sheer amount
of "Dependabot" messages is actually particularly unfair IMHO).
Gilles
>> [...]
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: [All] Useless update of "changes.xml"
Posted by Xeno Amess <xe...@gmail.com>.
thank is free imo...
a free thank for a free bot, sounds fair to me...
Xeno Amess
________________________________
From: Gilles Sadowski <gi...@gmail.com>
Sent: Monday, February 10, 2025 5:20:53 PM
To: Commons Developers List <de...@commons.apache.org>
Subject: [All] Useless update of "changes.xml"
Hi.
The commit below will generate a line in the release notes that says
"Thanks to Dependabot".
I don't that it is useful (IMHO, it is even harmful if it is littered
with hardly
informative automated messages that drown functional changes).
Fine if there is an easy and safe way to update a dependency, but
should we thank a robot?
Regards,
Gilles
Le lun. 10 févr. 2025 à 09:45, <en...@apache.org> a écrit :
>
> This is an automated email from the ASF dual-hosted git repository.
>
> engelen pushed a commit to branch master
> in repository https://gitbox.apache.org/repos/asf/commons-math.git
>
>
> The following commit(s) were added to refs/heads/master by this push:
> new aa1efd86a Update changes.xml
> aa1efd86a is described below
>
> commit aa1efd86a6ab5f229a3b579db16191d8e9672bf5
> Author: Arnout Engelen <ar...@bzzt.net>
> AuthorDate: Mon Feb 10 09:44:16 2025 +0100
>
> Update changes.xml
> ---
> src/changes/changes.xml | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/src/changes/changes.xml b/src/changes/changes.xml
> index bcd88487e..887ba868c 100644
> --- a/src/changes/changes.xml
> +++ b/src/changes/changes.xml
> @@ -96,6 +96,7 @@ Caveat:
> to support the whole codebase (it was one of the main reasons for
> creating more focused components).
> ">
> + <action dev="engelen" type="update" due-to="Dependabot">Bump org.apache.commons:commons-rng-bom from 1.5 to 1.6 #244</action>
> <action dev="erans" type="update" issue="MATH-1669" due-to="Wolff Bock von Wuelfingen">
> Javadoc: Fix broken link.
> </action>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
[All] Useless update of "changes.xml"
Posted by Gilles Sadowski <gi...@gmail.com>.
Hi.
The commit below will generate a line in the release notes that says
"Thanks to Dependabot".
I don't that it is useful (IMHO, it is even harmful if it is littered
with hardly
informative automated messages that drown functional changes).
Fine if there is an easy and safe way to update a dependency, but
should we thank a robot?
Regards,
Gilles
Le lun. 10 févr. 2025 à 09:45, <en...@apache.org> a écrit :
>
> This is an automated email from the ASF dual-hosted git repository.
>
> engelen pushed a commit to branch master
> in repository https://gitbox.apache.org/repos/asf/commons-math.git
>
>
> The following commit(s) were added to refs/heads/master by this push:
> new aa1efd86a Update changes.xml
> aa1efd86a is described below
>
> commit aa1efd86a6ab5f229a3b579db16191d8e9672bf5
> Author: Arnout Engelen <ar...@bzzt.net>
> AuthorDate: Mon Feb 10 09:44:16 2025 +0100
>
> Update changes.xml
> ---
> src/changes/changes.xml | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/src/changes/changes.xml b/src/changes/changes.xml
> index bcd88487e..887ba868c 100644
> --- a/src/changes/changes.xml
> +++ b/src/changes/changes.xml
> @@ -96,6 +96,7 @@ Caveat:
> to support the whole codebase (it was one of the main reasons for
> creating more focused components).
> ">
> + <action dev="engelen" type="update" due-to="Dependabot">Bump org.apache.commons:commons-rng-bom from 1.5 to 1.6 #244</action>
> <action dev="erans" type="update" issue="MATH-1669" due-to="Wolff Bock von Wuelfingen">
> Javadoc: Fix broken link.
> </action>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org