Hacktoberfest 2026：維護者為十月標記出來的 issue，仍然開放、適合新手。 瀏覽 Hacktoberfest issue

document dependabot PR review strategy

未關閉
  • 哪裡不對？
#2,014 11 則留言 0 個 reaction 已指派 2 人 在 GitHub 檢視

維護者通常 10 天內回覆

@lukpueh 已經在處理了。

開始於 2022年6月15日。

評估

這個 Issue 還沒有評估資料。

描述

documentation

This is what I believe makes sense:

  • "test" dependencies are mostly pinned to make sure we know which versions are being used and that the current version doesnt't surprisingly start breaking builds: reviewing the contents of test dependency updates is not required. If the tests pass that should be fine. Major updates could warrant a look in the changelog
  • actual run time dependency updates should be reviewed: what this means is case dependent, but as a minimum we should check the changelog. Reading the commit log or actual changes may be useful but can also be an unrealistic goal for some dependency updates.
  • The purpose of the dependency review is two-fold:
    • prevent depending on software that works differently than we expect (so API changes, other functionality changes, bugs)
    • prevent depending on software that is actually malicious (this is more relevant the newer the update is as a lot of malicious updates are noticed fairly quickly). It should be noted that pypi package can be malicious without the malicious code being in github: source code review only goes so far.

This isn't documented anywhere: it should be

主要語言
Python
星號
1.7k
分支
304
平均合併
9 小時 25 分鐘
30 天內合併 PR
14

環境準備

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

theupdateframework/python-tuf 的其他 Issue

查看 theupdateframework/python-tuf 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。