chore(deps): consolidate dependabot updates and bump all dependencies#266
chore(deps): consolidate dependabot updates and bump all dependencies#266
Conversation
Bump all pending dependabot PRs in one commit and reconfigure dependabot to run weekly with max 1 open PR per ecosystem. - psutil 6.1.1 → 7.2.2 - transformers 4.57.1 → 5.4.0 - protobuf 6.33.5 → 7.34.1 - sphinx 8.2.3 → 9.1.0 - sphinx-rtd-theme 3.0.2 → 3.1.0 - sphinx-autodoc-typehints 3.1.0 → 3.9.11 - myst-parser 4.0.1 → 5.0.0 - pytest-cov 7.0.0 → 7.1.0 - scipy 1.16.3 → 1.17.1 - aiohttp 3.13.4 → 3.13.5 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
MLCommons CLA bot All contributors have signed the MLCommons CLA ✍️ ✅ |
There was a problem hiding this comment.
Pull request overview
Consolidates multiple pending Dependabot updates into a single dependency bump commit, and adjusts Dependabot configuration to reduce update noise by switching to a weekly cadence with a 1-PR limit per ecosystem.
Changes:
- Bumped pinned versions for several runtime/dev/test Python dependencies in
pyproject.toml(including multiple major-version upgrades). - Reconfigured Dependabot to run weekly (Monday) and limit to 1 open PR per ecosystem in
.github/dependabot.yml.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
pyproject.toml |
Updates pinned dependency versions across core, dev-docs, and test extras. |
.github/dependabot.yml |
Changes update cadence to weekly (Monday) and caps open Dependabot PRs at 1 per ecosystem. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Dependabot configuration to run weekly on Mondays and limits open pull requests to one per ecosystem. It also updates several dependencies in pyproject.toml, including major version bumps for psutil, transformers, protobuf, sphinx, and myst-parser. Feedback was provided regarding the risk of bundling multiple major version upgrades into a single pull request, suggesting they be isolated to simplify testing and debugging.
apply dependabot fixes:
change dependabot to run weekly and have upto 1 open PR at a time.
What does this PR do?
Type of change
Related issues
Testing
Checklist