Closed
Description
Problem
We do not have a policy for upgrading the dependencies we rely upon.
Goal
Our goal is to develop a policy that answers:
- How do we propose and assess the need for a dependency upgrade?
- How do we implement and review a dependency upgrade?
Tasks
- Decide where this policy will be documented.
- Document an assessment procedure:
- Decide where upgrade assessments should be documented (e.g. PR, issue, project)
- Identify required information for an upgrade decision
- Define (or rule out) a measure for perceived importance and/or complexity
- Document a review procedure:
- Identify required information for implementation and review
-
Define a test planreally just standard review procedure, any strict definition can be done with workflow impl
Several items are out of scope for this issue, but have been acknowledged as potential future work:
- Upgrade workflows and automation
- Regular auditing of dependencies
- Addressing implications of deferring/denying upgrades (e.g. security)
Metadata
Metadata
Assignees
Labels
No labels