Commit Graph
11 Commits
Author SHA1 Message Date
Arnold GalovicsandAleksandar Vidakovic 51782cb642 Dependency fixes for compatibility 2022-08-17 10:53:45 +02:00
Arnold GalovicsandArnold Gálovics 0bbcc72513 Renovate fixes for upcoming dep upgrade 2022-07-01 10:30:02 +02:00
Arnold GalovicsandArnold Gálovics 79375a8b91 Renovate adjustments 2022-06-14 09:15:29 +02:00
NaveenandAleksandar Vidakovic 69a900492c chore: renovate bot setting to pin actions to a full length commit SHA
- https://docs.renovatebot.com/modules/manager/github-actions/#additional-information

- Pinned actions by SHA https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies

>Pin actions to a full length commit SHA

>Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.
> Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository,
> as they would need to generate a SHA-1 collision for a valid Git object payload.

- https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
- https://github.com/renovatebot/.github/blob/b0c3aa85ef2bb242580f20b02b380ca532b4ce17/default.json#L13
2022-05-20 19:31:21 +02:00
taskain7andArnold Gálovics eb11c32ee3 FINERACT-1483: fix Sonar Security Hotspots 2022-04-11 17:44:05 +02:00
Aleksandar VidakovicandAleksandar Vidakovic cb87c9f550 Use 'renovate' for aggregated dependency upgrades (update) 2022-04-05 17:11:39 +02:00
Aleksandar VidakovicandAleksandar Vidakovic 35c835f4b5 Use 'renovate' for aggregated dependency upgrades 2022-04-05 15:52:44 +02:00
Sergio ZharinovandPetri Tuomola e985597492 Make Renovate Bot propose bumps to update spring-framework-bom (FINERACT-1192)
All credit for this magic ;) goes https://github.com/zharinov.

See https://github.com/apache/fineract/pull/1372.
2020-10-10 18:56:16 +03:00
Rhys ArkinsandMichael Vorburger ⛑️ 526a964418 Reduce AWS SDK Dependency Updating to monthly
This Renovate Bot configuration change will mean that PRs for `com.amazonaws:aws-java-sdk-s3` will be created only on the first day of each month. Existing (open) PRs will continue to get rebased (if conflicted) or updated (if a newer version gets released), but once the PR is merged or closed then another one won't be created again until the next month.

Discussion: https://github.com/apache/fineract/pull/1071#issuecomment-644957795
2020-06-17 22:10:28 +02:00
Michael Vorburger ⛑️ 734cbb1d1f Renovate ignore docs/ and add label [FINERACT-962] 2020-06-02 19:57:42 +02:00
Renovate BotandMichael Vorburger ⛑️ 9558f53765 Add renovate.json 2020-06-02 19:57:42 +02:00