Rust crate dependency updates in `rust/` go unnoticed
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 70/100
- Issue type
- Feature
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- rust
- Domain
- build-system, tooling
Research direction
Look at the existing .github/dependabot.yml file to see how other ecosystems are configured. Add a cargo entry for the /rust directory. Check the Dependabot documentation for the correct syntax and frequency options. Verify the configuration by checking if the file is valid YAML and the path is correct.
Written by the indexing model from the issue text.
Description
Summary
The crate dependencies under rust/ (ruby-rbs, ruby-rbs-sys) are never updated automatically, and nothing notifies us when a new version is released.
Details
Current direct dependencies
| Crate | Requirement | Locked version | Latest on crates.io | Used in |
|---|---|---|---|---|
xxhash-rust |
0.8 |
0.8.15 | 0.8.18 | ruby-rbs |
serde |
1.0 |
1.0.229 | 1.0.229 | ruby-rbs (build) |
serde_yaml |
0.9 |
0.9.34+deprecated | 0.9.34+deprecated (unmaintained https://github.com/rustsec/advisory-db/issues/2132) | ruby-rbs (build) |
tempfile |
3 |
3.27.0 | 3.27.0 | ruby-rbs (dev) |
bindgen |
0.72.0 |
0.72.0 | 0.73.2 | ruby-rbs-sys (build) |
cc |
1.2.29 |
1.2.29 | 1.4.7 | ruby-rbs-sys (build) |
None of the direct dependencies is a major version behind yet, but if one becomes so in the future, there is currently nothing that would make us notice.
Proposed fix
Add a cargo ecosystem to .github/dependabot.yml for /rust, so crate updates open PRs weekly like the other ecosystems.
Maybe, It seems there is room for debate as to whether “weekly” is the appropriate frequency.
Not covered
Replacing serde_yaml.
This is also a problem, so it would be better to replace it with a new one.
- Dominant language
- Ruby
- Stars
- 2.2k
- Forks
- 256
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 35
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from ruby/rbs
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
Difficulty 1/5 Under an hour Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 1/5 Under an hour Newbie friendliness 35/100
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
palladius/rails8-app-on-gcp#145 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
rubocop/rubocop-rspec#2236 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
riscv/riscv-unified-db#2624 · 1 reaction ·
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100