Skip to content

chore: shipped dependency bumps cut a patch release - #212

Merged
kennywillbe merged 1 commit into
mainfrom
chore/deps-release-policy
Sep 1, 2026
Merged

chore: shipped dependency bumps cut a patch release#212
kennywillbe merged 1 commit into
mainfrom
chore/deps-release-policy

Conversation

@kennywillbe

Copy link
Copy Markdown
Owner

What and why

Dependabot's cargo PRs now arrive as fix(deps): — those dependencies ship inside the binary, so each bump makes the release PR propose a patch. Actions and Docker bumps stay build(deps): (CI-only, no bump) but appear in the changelog under a new Dependencies section via changelog-sections. The release PR still merges by hand. Documented in releasing.md.

How it was verified

  • ./dev/ci-local.sh --fastRESULT: green — 4 passed, 7 skipped; mdbook build green; both configs parse

Checklist

  • Comments explain why, not what
  • No architecture boundary crossed
  • Docs updated for behaviour or configuration changes
  • No secrets in code, tests, logs or fixtures

A cargo dependency ends up inside the binary, so its bump is a fix a
user can only receive through a release. Actions and image bumps never
reach a user and stay build commits, now surfaced as a Dependencies
changelog section instead of vanishing.
@kennywillbe
kennywillbe enabled auto-merge (squash) September 1, 2026 12:07
@kennywillbe
kennywillbe merged commit 47f1400 into main Sep 1, 2026
11 checks passed
@kennywillbe
kennywillbe deleted the chore/deps-release-policy branch September 1, 2026 12:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant