Repository navigation
chore(deps): add a dependabot cooldown, drop the stale vue 2 ignores - #2130
Merged
Merged
Conversation
AndyScherzinger
force-pushed
the
chore/noid/dependabot-drop-vue2-ignores
branch
from
November 11, 2026 23:24
ef2b3eb to
eb75c91
Compare
AndyScherzinger
changed the title
AndyScherzinger
force-pushed
the
chore/noid/dependabot-drop-vue2-ignores
branch
from
November 11, 2026 23:26
eb75c91 to
c2384d2
Compare
AndyScherzinger
changed the title
A 10 day cooldown on all three ecosystems, so a release has to survive in the wild before it is proposed here. Nextcloud's own packages are excluded: they ship in lockstep with the server and are wanted as soon as they are out. This follows what spreed does, at 10 days instead of 7. The two npm ignores were held back "until we move to vue 3". That move landed in #1953 on 2026-07-28, so the reason no longer applies to either, but only one of them can be released outright. @nextcloud/vue 9.x targets Nextcloud 31 and newer, below the app's min-version of 33, so its ignore only holds back 9.11.0 -> 9.14.1 and is dropped. @nextcloud/dialogs 8.x requires Nextcloud 35, while info.xml declares min-version 33, so its ignore stays but now covers >=8 only. 7.x updates are proposed again; the whole entry can go once the floor moves to 35. The composer ignore for nextcloud/ocp is unrelated and stays: it tracks the supported server branch and is maintained by the update-nextcloud-ocp-matrix workflow. Assisted-by: Claude Code:claude-opus-5[1m] Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
AndyScherzinger
force-pushed
the
chore/noid/dependabot-drop-vue2-ignores
branch
from
November 11, 2026 23:28
c2384d2 to
c97e3ab
Compare
AndyScherzinger
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two things, both in
.github/dependabot.yml.Cooldown
A 10 day cooldown on all three ecosystems, so a release has to survive in the wild for a while before it is proposed here. Nextcloud's own packages are excluded — they ship in lockstep with the server and are wanted as soon as they are out. This follows what spreed does, at 10 days instead of 7.
spreed excludes on its npm ecosystems only. Here the exclude is on composer too, as
nextcloud/*, sonextcloud/coding-standardis not held back either.github-actionshas no exclude; say the word ifnextcloud-libraries/*andnextcloud-releases/*should skip the wait as well.The Vue 2 ignores
Both npm ignores said "until we move to vue 3". That move landed in #1953, merged 2026-07-28, and
package.jsonhas been onvue ^3.5.45since — dependabot has been bumping Vue itself all along, most recently in b2f01c2. So the stated reason is obsolete for both, but only one of them can be released outright.@nextcloud/vue@nextcloud/dialogs>=8info.xmldeclaresmin-version="33", so@nextcloud/dialogs8.x would drop support for 33 and 34. Rather than ignoring the package outright, the ignore now covers the 8 series only, so 7.x updates are proposed again:The whole entry can go once the minimum server version moves to 35.
The composer ignore for
nextcloud/ocpis unrelated and untouched — that pin tracks the supported server branch and is maintained byupdate-nextcloud-ocp-matrix.yml.Sources: the version compatibility tables in the nextcloud-dialogs and nextcloud-vue READMEs.
🤖 AI (if applicable)