mathben/erplibre
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

[FIX] dependabot: exclude Odoo 12-17 from security updates too

Browse source 
Security updates reuse a dependabot.yml entry only when its directory
matches the manifest's; they scan requirement/ as "/requirement", which
no entry declared, so their pull requests bumped the frozen pins of
Odoo 12 to 17. Only Odoo 18 now receives updates. Globs replace the
exact names and also cover ignore_requirements, pyproject and poetry.lock.
Checked: the YAML parses and the globs match 27 files in requirement/,
none for odoo18. Not yet checked on GitHub: takes effect once on master.

--- FR ---

[FIX] dependabot : exclure aussi Odoo 12-17 des mises à jour de sécurité

Les mises à jour de sécurité ne reprennent une entrée de dependabot.yml
que si son répertoire correspond à celui du manifeste ; elles lisent
requirement/ comme « /requirement », qu'aucune entrée ne déclarait, d'où
des PR qui modifiaient les versions figées d'Odoo 12 à 17. Seul Odoo 18
reçoit désormais les mises à jour. Des globs remplacent les noms exacts
et couvrent aussi ignore_requirements, pyproject et poetry.lock.
Vérifié : le YAML se lit et les globs ciblent 27 fichiers de requirement/,
aucun pour odoo18. Non vérifié sur GitHub : effectif une fois sur master.

Assisted-by: Claude Opus 5.5
This commit is contained in:
Mathieu Benoit 2026-09-25 02:29:26 -04:00
parent 9967a3b758
commit 884b02f7c5
1 changed files with 13 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
.github/dependabot.yml vendored
View file

@ -1,13 +1,19 @@
version: 2 version: 2
updates: updates:
# Security updates reuse this entry only when its directory matches the
# manifest's own; they scan requirement/ as "/requirement", so both are listed.
- package-ecosystem: "pip" - package-ecosystem: "pip"
directory: "/" directories:
- "/"
- "/requirement"
schedule: schedule:
interval: "daily" interval: "daily"
# Odoo versions kept only as migration sources: their pins stay frozen.
# Globs cover requirements, ignore_requirements, pyproject and poetry.lock.
exclude-paths: exclude-paths:
- "requirement/requirements.odoo12.0_python3.7.17.txt" - "**/*odoo12.0_*"
- "requirement/requirements.odoo13.0_python3.7.17.txt" - "**/*odoo13.0_*"
- "requirement/requirements.odoo14.0_python3.8.20.txt" - "**/*odoo14.0_*"
- "requirement/requirements.odoo15.0_python3.8.20.txt" - "**/*odoo15.0_*"
- "requirement/requirements.odoo16.0_python3.10.18.txt" - "**/*odoo16.0_*"
- "requirement/requirements.odoo17.0_python3.10.18.txt" - "**/*odoo17.0_*"