update commons-io to 2.12.0 #653
Conversation
|
why we not have an issue for it ... when we not need issue? - do we have such rules or agreements? |
|
We honestly don't seem to have any consensus on filing issues for straightforward dependency upgrades like this one. I've been told by some reviewers on some PRs to file issues and on others by other reviewers not to file issues. If we're going to use dependabot or renovatebot, requiring Jira issues mostly defeats the purpose. Unless it resolves an active bug in the Maven project itself — not the dependency — my preference is not to file an issue. And if it does resolve a bug, the issue should focus on the bug, not the dependency upgrade. As a user I prefer to not have the release notes cluttered with dependency upgrades that have no visible effect on my work. |
|
FYI commit messages are the same. Different reviewers request different and sometimes contradictory commit conventions. There aren't any established project wide standards for this that anyone pays attention to. |
|
I suppose there's some dispute about what constitutes a "trivial change". Again, some reviewers tell me not to file issues for this sort of thing. Some tell me to file issues. There simply isn't consensus here. And if we require Jira issues for every dependency change, dependabot really doesn't work. :-( |
No description provided.