🏗📦 Switch renovate updates for amphtml from opt-in to opt-out#27692
🏗📦 Switch renovate updates for amphtml from opt-in to opt-out#27692rsimha merged 1 commit intoampproject:masterfrom rsimha:2020-04-10-Renovate
amphtml from opt-in to opt-out#27692Conversation
|
I've checked boxes in the PR description for the files that we know can be kept up to date. Adding a few WGs to review the rest. Let me know if it's okay for these files to be kept up to date by renovate. If not, we can opt them out.
|
package.json filesamphtml from opt-in to opt-out
|
For (I'm trying to avoid cc'ing honeybadger since they've already got enough on their plate. I may have to... we'll see.) |
@twifkak the default answer to both these questions is yes. However, we can adjust things to make the updates less frequent, or group them up if you prefer. See the renovate docs for more info. The main goal is to prevent security vulnerabilities from sitting around for long (as is currently the case with the Java Validator). /cc @rcebulko as an FYI, in light of ampproject/amp-github-apps#284 (comment) |
|
Bumping this PR for input from all the working groups. The option I am considering right now is to enable updates for all these sets of packages and fine tune later as the updates start coming in. The reason this is slightly urgent is that we currently have a bunch of security vulnerabilities that are easily prevented once this PR lands. |
|
//cc @GeorgeLuo for |
honeybadgerdontcare
left a comment
There was a problem hiding this comment.
approved for validator change. asking @GeorgeLuo to approve in comments for Java validator.
|
Merging this PR so we can quickly address existing security vulnerabilities. Owners of individual package files: If you want to opt out of updates for a package file, add it to |
|
|
When renovate was originally installed to keep
amphtmldependencies up to date, only the rootpackage.jsonwas opted in.Since then, various developers have added a bunch of new
package.json/pom.xmlfiles without opting them in to automatic updates. This frequently results in security vulnerabilities due to outdated dependencies.This PR removes the
includePathssection of.renovaterc.jsonand enables automatic updates for the following files:package.jsonextensions/amp-viewer-integration/0.1/messaging/package.jsonextensions/amp-access/0.1/iframe-api/package.jsonvalidator/package.jsonvalidator/gulpjs/package.jsonvalidator/java/pom.xmlvalidator/nodejs/package.jsonvalidator/webui/package.jsonthird_party/amp-toolbox-cache-url/package.jsonbuild-system/tasks/storybook/package.jsonbuild-system/tasks/visual-diff/package.jsonbuild-system/tasks/performance/package.jsonbuild-system/tasks/e2e/package.jsonsrc/purifier/package.jsonI'll merge this after checking with the respective owners on whether automatic updates are desirable, and if not, we can add specific files to
ignorePaths.With this, security vulnerability reports for AMP should become less frequent.