Commits on Nov 16, 2023

1. Configure Dependabot to update all RubyGems …

   By default Dependabot only monitors direct dependencies (those specified
   in the Gemfile) for updates. It appears to use `bundle update
   <dependency>` under the hood, which means that a Dependabot PR to update
   <dependency> can also include updates to sub-dependencies. This makes it
   harder to review because the PR will only include the Changelog of
   <dependency> and not of the sub-dependencies.
   
   My hope is that by configuring Dependabot to monitor direct and indirect
   (sub) dependencies[1] we'll end up with more, smaller/easier to review,
   PRs.
   
   I think the same change[2] has been working reasonably well in Signon
   and thought it was worth bringing gds-sso into line.
   
   [1]: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#allow
   [2]: alphagov/signon#2382

   

   chrisroos committed Nov 16, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for c0c7765
   • Browse repository at this point

   Copy the full SHA

   c0c7765 View commit details

   Browse the repository at this point in the history