From 605859087221d1976c84fd982d2e94c9e2813e33 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Wed, 16 Sep 2026 13:05:14 +0200 Subject: [PATCH] chore(deps): keep PostgreSQL majors out of the update stream The compose ecosystem added last change did its job on the first run and immediately proposed 16.15 to 18.6. A PostgreSQL major changes the on-disk format, so merging that would hand self-hosters a container that cannot read their data directory without pg_upgrade or a dump and restore. Minor releases keep arriving as reviewable PRs; a major is a project decision with a migration path behind it, not a weekly bump. The guard grows a case for the ignore rule, so dropping it fails rather than quietly re-opening the door. --- .github/dependabot.yml | 9 +++++++++ src/__tests__/database-pin-is-watched.test.ts | 10 ++++++++++ 2 files changed, 19 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 46efc732f..7d8e7f98f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -38,3 +38,12 @@ updates: schedule: interval: "weekly" open-pull-requests-limit: 3 + ignore: + # A PostgreSQL major is a migration, not an update: the on-disk format + # changes, so the operator has to run pg_upgrade or dump and restore. + # The first run of this ecosystem proposed 16.15 -> 18.6, which would + # have handed self-hosters a database their data directory cannot be + # read by. Minor releases still arrive as PRs; a major is a deliberate + # project decision with a migration guide behind it. + - dependency-name: "postgres" + update-types: ["version-update:semver-major"] diff --git a/src/__tests__/database-pin-is-watched.test.ts b/src/__tests__/database-pin-is-watched.test.ts index 2ab74ceff..09c740e0b 100644 --- a/src/__tests__/database-pin-is-watched.test.ts +++ b/src/__tests__/database-pin-is-watched.test.ts @@ -36,6 +36,16 @@ describe("the bundled database pin", () => { expect(images[0]).toMatch(/^postgres:\d+\.\d+-alpine$/); }); + it("lets a major version through only as a decision, never as an update PR", () => { + const dependabot = read(".github/dependabot.yml"); + // The first run of the compose ecosystem proposed 16.15 -> 18.6. A + // PostgreSQL major changes the on-disk format, so it is a migration the + // project schedules, not an update an operator merges on a Tuesday. + expect(dependabot).toMatch( + /dependency-name:\s*"postgres"[\s\S]{0,200}version-update:semver-major/, + ); + }); + it("is watched by the compose ecosystem, which is not the Dockerfile one", () => { const dependabot = read(".github/dependabot.yml"); const ecosystems = [