[hakari] [Support question] How to make dependabot play nice with hakari?

[VorpalBlade]

So, I'm overall happy with hakari, but I have run into an issue: It doesn't play nice with dependabot for automatic updates:

• Dependabot will try to update some indirect dependency that is mentioned as a direct dependency in the workspace hack crate to a new semver major version
• However, the direct dependency that has this indirect dependency has not yet upgraded to that new semver major version. So we don't want the upgrade PR for the workspace crate.

See for example this dependabot PR to one of my projects: VorpalBlade/paketkoll#103

Do you have any workaround for this? I looked through the dependabot configuration and couldn't really find anything. I have not looked at alternatives (such as renovate), maybe they support this better, but I was hoping for a quick fix.

How do you deal with it for your own projects?

[sunshowers]

Hi, thanks for the issue! This is definitely an unfortunate wart with hakari, and I don't know of a way to handle this within Dependabot.

For this repo, and at my workplace (Oxide), we switched to Renovate partly for this reason.

The configs are:

• Self-hosting Renovate: https://github.com/nextest-rs/renovate?tab=readme-ov-file#self-hosting-renovate
• post-upgrade.json: https://github.com/nextest-rs/renovate/blob/main/post-upgrade.json
• This script that gets run by Renovate: https://github.com/guppy-rs/guppy/blob/main/scripts/renovate-post-upgrade.sh

I would eventually like hakari to go away, if and when Rust RFC 3692 becomes stabilized.

[VorpalBlade]

Thanks, I'll have to put learning renovate on my todo list I guess.

[VorpalBlade]

Since you otherwise have such excellent docs on how to use hakari and best practises: might I suggest adding a short note about this there? Probably under the "Making hakari work well" heading?

[sunshowers]

Agreed, that would be good. Would you like to submit a PR? Otherwise I'll probably get to this in the next couple of weeks.

[VorpalBlade]

I'll make no promises as to what I have the time or energy to work on when it comes to open source. So if I haven't made a PR when you get around to it: go ahead.