From bad8183e10ab02bcb4c9c5a23ab8bf38c9d08374 Mon Sep 17 00:00:00 2001 From: Baptiste Canton Date: Sun, 23 Aug 2026 00:06:06 +0200 Subject: [PATCH] chore(renovate): stop proposing major bumps of indirect deps In Go a major version is part of the import path, so bumping one means editing import statements inside the module that requires it. For an indirect dependency that module is not this repo, and nothing here imports these packages, so the update is not actionable. The dashboard has been offering four of them every week: go.yaml.in/yaml/v2 -> v3 and gopkg.in/yaml.v2 -> v3 (both v3 modules are already in go.mod alongside their v2 counterparts, pulled in by different parents), plus go-github/v86 -> v90 and gitlab client-go -> v2. gomodTidy would revert any of them. Minor and patch updates for indirect deps still flow through the existing group, so transitive fixes are unaffected. Co-Authored-By: Claude Opus 5 --- .github/renovate.json | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/renovate.json b/.github/renovate.json index 067e5dd5a..bbc5dfc51 100644 --- a/.github/renovate.json +++ b/.github/renovate.json @@ -65,6 +65,19 @@ "enabled": true, "groupName": "go indirect dependencies" }, + { + "description": "a Go major bump is an import-path change, so for an indirect dep it can only happen inside the parent module; nothing here can act on it", + "matchManagers": [ + "gomod" + ], + "matchDepTypes": [ + "indirect" + ], + "matchUpdateTypes": [ + "major" + ], + "enabled": false + }, { "description": "constrained by the deprecated github.com/google/generative-ai-go, whose build breaks against newer go/ai; remove after migrating to google.golang.org/genai", "matchManagers": [