Skip to content

Dependency Upgrade Policy #35

Closed
@tukib

Description

@tukib

Problem

We do not have a policy for upgrading the dependencies we rely upon.

Goal

Our goal is to develop a policy that answers:

  • How do we propose and assess the need for a dependency upgrade?
  • How do we implement and review a dependency upgrade?

Tasks

  • Decide where this policy will be documented.
  • Document an assessment procedure:
    • Decide where upgrade assessments should be documented (e.g. PR, issue, project)
    • Identify required information for an upgrade decision
    • Define (or rule out) a measure for perceived importance and/or complexity
  • Document a review procedure:
    • Identify required information for implementation and review
    • Define a test plan really just standard review procedure, any strict definition can be done with workflow impl

Several items are out of scope for this issue, but have been acknowledged as potential future work:

  • Upgrade workflows and automation
  • Regular auditing of dependencies
  • Addressing implications of deferring/denying upgrades (e.g. security)

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions