mirror of
https://github.com/unslothai/unsloth.git
synced 2026-08-25 00:33:49 +00:00
4dfae2974a
* Dependabot: pin glib and gdk-pixbuf to the GTK3 0.18 line Tauri v2 renders Studio on Linux through GTK3. The gtk-rs GTK3 bindings are frozen at 0.18.2 and will never ship a 0.19+, but glib and gdk-pixbuf keep releasing, so Dependabot proposes 0.22 for them while gtk/gdk stay on 0.18. That puts two incompatible copies of glib in one tree and breaks the Linux build: native_clipboard.rs hands a gdk_pixbuf::Pixbuf to a gtk::Clipboard, and the two crate versions are distinct types. Ignore 0.19+ for both so 0.18.x patches still flow. * Correct the ignore-block comment Two fixes to the comment, no config change. The failure mode was described backwards. native_clipboard.rs never writes to the clipboard; it reads. gtk::Clipboard::wait_for_image returns a Pixbuf from gtk 0.18 transitive gdk-pixbuf, and the None arm falls back to read_gtk_clipboard_file_image, which returns the direct gdk_pixbuf::Pixbuf. Bumping the direct crate to 0.22 makes the two match arms disagree and mismatches encode_clipboard_pixbuf. Dropped "so 0.18.x patches still flow". Both crates ended their 0.18 line at 0.18.5 on 2023-12-30 and moved to 0.19.0 on 2024-02-04, so no further 0.18.x will ship and the sentence promised nothing. Say instead what the ignore actually costs: a versions range suppresses security PRs too, not just version updates, so a future advisory fixed above 0.18 will alert without opening a PR. Also 9 comment lines down to 7. --------- Co-authored-by: danielhanchen <unslothshared@gmail.com>
112 lines
3.7 KiB
YAML
112 lines
3.7 KiB
YAML
---
|
|
version: 2
|
|
updates:
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
cooldown:
|
|
# github-actions refs are git tags / SHAs, not semver -- the
|
|
# `semver-minor-days` / `semver-patch-days` knobs are rejected
|
|
# by Dependabot's validator for this ecosystem. Only the
|
|
# `default-days` floor applies.
|
|
default-days: 7
|
|
groups:
|
|
actions:
|
|
patterns: ["*"]
|
|
actions-security:
|
|
applies-to: security-updates
|
|
patterns: ["*"]
|
|
|
|
# Removed a stray `package-ecosystem: "bun"` entry for
|
|
# /studio/frontend: that path has no bun.lock / bun.lockb, so
|
|
# Dependabot's bun ecosystem silently no-ops on it. The actual
|
|
# lockfile committed at /studio/frontend is package-lock.json
|
|
# (npm), and the npm entry further below already catches
|
|
# npm_and_yarn security advisories for that directory. Version
|
|
# updates for /studio/frontend stay suppressed (open-pull-
|
|
# requests-limit: 0 in that entry) -- security PRs flow through
|
|
# regardless. Add a real bun entry IF and WHEN bun.lock lands.
|
|
|
|
- package-ecosystem: "npm"
|
|
directory: "/studio/backend/core/data_recipe/oxc-validator"
|
|
schedule:
|
|
interval: "weekly"
|
|
cooldown:
|
|
default-days: 7
|
|
semver-minor-days: 3
|
|
semver-patch-days: 3
|
|
groups:
|
|
npm-oxc-validator:
|
|
patterns: ["*"]
|
|
npm-oxc-validator-security:
|
|
applies-to: security-updates
|
|
patterns: ["*"]
|
|
|
|
# pip + cargo grouped weekly; the *-security siblings batch
|
|
# advisories that would otherwise each open their own PR.
|
|
- package-ecosystem: "pip"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 5
|
|
cooldown:
|
|
default-days: 7
|
|
groups:
|
|
python:
|
|
patterns: ["*"]
|
|
python-security:
|
|
applies-to: security-updates
|
|
patterns: ["*"]
|
|
|
|
- package-ecosystem: "cargo"
|
|
directory: "/studio/src-tauri"
|
|
schedule:
|
|
interval: "weekly"
|
|
cooldown:
|
|
default-days: 7
|
|
semver-minor-days: 3
|
|
semver-patch-days: 3
|
|
# Tauri renders Studio on Linux through GTK3 and the gtk-rs GTK3
|
|
# bindings are archived at 0.18.2, so `gtk`/`gdk` will never ship
|
|
# 0.19+. Moving `glib`/`gdk-pixbuf` past 0.18 puts two
|
|
# incompatible copies in the tree and native_clipboard.rs stops
|
|
# compiling: `gtk::Clipboard::wait_for_image` returns a 0.18
|
|
# `Pixbuf` our `gdk_pixbuf` no longer accepts. This also
|
|
# suppresses security PRs above 0.18, leaving alerts only.
|
|
ignore:
|
|
- dependency-name: "glib"
|
|
versions: [">= 0.19"]
|
|
- dependency-name: "gdk-pixbuf"
|
|
versions: [">= 0.19"]
|
|
groups:
|
|
cargo-tauri:
|
|
patterns: ["*"]
|
|
cargo-tauri-security:
|
|
applies-to: security-updates
|
|
patterns: ["*"]
|
|
|
|
# /studio/frontend npm dependencies. Version-update PRs are
|
|
# deliberately suppressed (open-pull-requests-limit: 0) -- the
|
|
# frontend dep tree is large, the lockfile is the authoritative
|
|
# pin, and `min-release-age=7` in studio/frontend/.npmrc already
|
|
# blocks fresh tarballs at install time. Security advisories
|
|
# arrive via GitHub's npm_and_yarn channel and are NOT capped by
|
|
# `open-pull-requests-limit` per Dependabot's documented
|
|
# behaviour; they flow through this entry, group together, and
|
|
# still respect the cooldown below so we never ingest a tarball
|
|
# that was hot-published less than 3 days ago.
|
|
- package-ecosystem: "npm"
|
|
directory: "/studio/frontend"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 0
|
|
cooldown:
|
|
default-days: 7
|
|
semver-minor-days: 3
|
|
semver-patch-days: 3
|
|
groups:
|
|
npm-frontend-security:
|
|
applies-to: security-updates
|
|
patterns: ["*"]
|
|
...
|