From eaa89455d159ee6cfb99f11d329c7f8326677b4e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zolt=C3=A1n=20Leh=C3=B3czky?= Date: Thu, 3 Oct 2024 23:17:21 +0200 Subject: [PATCH 1/4] Batching Dependabot updates per directories --- .github/dependabot.yml | 49 +++++++++++++++++++++++++++++++++++++++--- 1 file changed, 46 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index a0ae63c5d47..c0deefe784b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,11 +1,54 @@ version: 2 updates: - - package-ecosystem: "nuget" # See documentation for possible values - directory: "/" # Location of package manifests + # Dependabot can handle at most 150 "manifests", so for NuGet, csprojs referencing packages (see docs: + # https://docs.github.com/en/enterprise-cloud@latest/code-security/supply-chain-security/understanding-your-software-supply-chain/troubleshooting-the-dependency-graph#are-there-limits-which-affect-the-dependency-graph-data). + # We're grouping updates per directories to have smaller batches. + # /src/OrchardCore + - package-ecosystem: "nuget" + directory: "/src/OrchardCore" + schedule: + interval: "weekly" + groups: + all-dependencies: + patterns: + - "*" + # /src/OrchardCore.Modules + - package-ecosystem: "nuget" + directory: "/src/OrchardCore.Modules" + schedule: + interval: "weekly" + groups: + all-dependencies: + patterns: + - "*" + # /src/OrchardCore.Themes + - package-ecosystem: "nuget" + directory: "/src/OrchardCore.Themes" + schedule: + interval: "weekly" + groups: + all-dependencies: + patterns: + - "*" + # All other folders under src/. + - package-ecosystem: "nuget" + directories: + - "/src/OrchardCore.Build" + - "/src/OrchardCore.Cms.Web" + - "/src/OrchardCore.Mvc.Web" + - "/src/Templates**" + schedule: + interval: "weekly" + groups: + all-dependencies: + patterns: + - "*" + # /test + - package-ecosystem: "nuget" + directory: "/test" schedule: interval: "weekly" groups: - # Grouped version updates configuration all-dependencies: patterns: - "*" From 9d7698b6d76c366fcfba311357dd5bb189138201 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zolt=C3=A1n=20Leh=C3=B3czky?= Date: Fri, 4 Oct 2024 01:33:55 +0200 Subject: [PATCH 2/4] Fixing Dependabot updates --- .github/dependabot.yml | 53 +++++--------------------- Directory.Packages.props | 28 ++++---------- src/docs/resources/libraries/README.md | 1 - 3 files changed, 17 insertions(+), 65 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c0deefe784b..bdbcf2043ab 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -2,53 +2,20 @@ version: 2 updates: # Dependabot can handle at most 150 "manifests", so for NuGet, csprojs referencing packages (see docs: # https://docs.github.com/en/enterprise-cloud@latest/code-security/supply-chain-security/understanding-your-software-supply-chain/troubleshooting-the-dependency-graph#are-there-limits-which-affect-the-dependency-graph-data). - # We're grouping updates per directories to have smaller batches. - # /src/OrchardCore + # Thus, it would fail for the whole solution. + # Grouping updates per directories or otherwise trying to have smaller batches is unnecessary, because due to + # centralized package management, Dependabot will find all dependencies from any project. So, just processing the + # OrchardCore project. - package-ecosystem: "nuget" - directory: "/src/OrchardCore" - schedule: - interval: "weekly" - groups: - all-dependencies: - patterns: - - "*" - # /src/OrchardCore.Modules - - package-ecosystem: "nuget" - directory: "/src/OrchardCore.Modules" - schedule: - interval: "weekly" - groups: - all-dependencies: - patterns: - - "*" - # /src/OrchardCore.Themes - - package-ecosystem: "nuget" - directory: "/src/OrchardCore.Themes" - schedule: - interval: "weekly" - groups: - all-dependencies: - patterns: - - "*" - # All other folders under src/. - - package-ecosystem: "nuget" - directories: - - "/src/OrchardCore.Build" - - "/src/OrchardCore.Cms.Web" - - "/src/OrchardCore.Mvc.Web" - - "/src/Templates**" - schedule: - interval: "weekly" - groups: - all-dependencies: - patterns: - - "*" - # /test - - package-ecosystem: "nuget" - directory: "/test" + directory: "/src/OrchardCore/OrchardCore" schedule: interval: "weekly" groups: all-dependencies: patterns: - "*" + ignore: + # We'll update GraphQL for v3 because it's breaking, see https://github.com/OrchardCMS/OrchardCore/issues/16826. + - dependency-name: "GraphQL*" + # See the corresponding comment in Directory.Packages.props. + - dependency-name: "System.Drawing.Common" diff --git a/Directory.Packages.props b/Directory.Packages.props index 3d06fcdc244..1c7fcc1f572 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -1,18 +1,15 @@ - true true - 2.3.0 - - + @@ -41,11 +38,9 @@ - - - @@ -91,15 +85,13 @@ - - + - - - - + + + - + - - 8.0.8 8.0.8 - - @@ -157,11 +145,9 @@ - - - + \ No newline at end of file diff --git a/src/docs/resources/libraries/README.md b/src/docs/resources/libraries/README.md index 16d5464705b..e677f9e6aa6 100644 --- a/src/docs/resources/libraries/README.md +++ b/src/docs/resources/libraries/README.md @@ -26,7 +26,6 @@ The below table lists the different .NET libraries used in Orchard Core: | [Lucene.Net](https://github.com/apache/lucenenet) | .NET full-text search engine. | [Apache-2.0](https://github.com/apache/lucenenet/blob/master/LICENSE.txt) | | [MailKit](https://github.com/jstedfast/MailKit) | A cross-platform .NET library for IMAP, POP3, and SMTP. | [MIT](https://github.com/jstedfast/MailKit/blob/master/LICENSE) | | [Markdig](https://github.com/lunet-io/markdig) | .NET Markdown engine. | [BSD-2-Clause](https://github.com/lunet-io/markdig/blob/master/license.txt) | -| [MessagePack](https://github.com/neuecc/MessagePack-CSharp) | Extremely Fast MessagePack Serializer for C# | [MIT](https://github.com/neuecc/MessagePack-CSharp/blob/master/LICENSE) | | [Microsoft.Extensions.Http.Resilience](https://github.com/dotnet/extensions/tree/main/src/Libraries/Microsoft.Extensions.Http.Resilience) | Resilience mechanisms for HttpClient built on the Polly framework. | [MIT](https://github.com/dotnet/extensions/blob/main/LICENSE) | | [Microsoft.Identity.Web](https://github.com/AzureAD/microsoft-identity-web) | Helps creating protected web apps and web APIs with Microsoft identity platform and Azure AD B2C. | [MIT](https://github.com/AzureAD/microsoft-identity-web/blob/master/LICENSE) | | [Microsoft.SourceLink.GitHub](https://github.com/dotnet/sourcelink) | Source Link enables a great source debugging experience. | [MIT](https://github.com/dotnet/sourcelink/blob/main/License.txt) | From 940eb1304825d9a2cd809599ed92e83477579538 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zolt=C3=A1n=20Leh=C3=B3czky?= Date: Fri, 4 Oct 2024 01:36:52 +0200 Subject: [PATCH 3/4] Newline --- Directory.Packages.props | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index 1c7fcc1f572..ac8cb9f37bb 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -150,4 +150,4 @@ - \ No newline at end of file + From 87451a974024bc1b223564625e22f15dbe209951 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zolt=C3=A1n=20Leh=C3=B3czky?= Date: Fri, 4 Oct 2024 13:14:19 +0200 Subject: [PATCH 4/4] Update libphonenumber-csharp to v8.13.47 --- Directory.Packages.props | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index ac8cb9f37bb..bcb5e861f32 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -30,7 +30,7 @@ - + @@ -150,4 +150,4 @@ - + \ No newline at end of file