From f6ddd34b231c342a24ca722aeb0d51b8d740633a Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 05:09:50 +0000 Subject: [PATCH] chore(deps): hold Postgres majors on the sensitive tier, as wiki and bloodhound already do The sensitive tier's three Postgres volumes are quiesced data-directory tars in `make backup`, restorable only into the same major (ADR-0065), and trinity's converge timer deploys a merged bump within the hour. The wiki and bloodhound entries already ignore semver-major for postgres; this one did not, so a major bump would have reached the host with the previous night's set as the only way back. Both image names are held, because Immich's vectorchord build is its own image whose tag moves with the Postgres major too. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_013Dchg9vmfKeQd7uzRzPcLR --- .github/dependabot.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c008fd24..c18449e4 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -70,12 +70,28 @@ updates: # homelab-converge-sensitive applies it within the hour (#533), so review # it as one. Written before the host existed, for the reason the lab entry # gives: pins rot from the day they are written. + # + # Postgres majors are held, by wiki's rule below: the tier's three Postgres + # volumes — Immich's, Paperless's and Miniflux's — are quiesced data + # directory tars in `make backup`, restorable only into the same major, and + # a major is a dump and a restore (ADR-0065), never a digest bump. This + # entry carried no such line while wiki's and bloodhound's did, and here the + # merge IS the deploy: trinity would have started the next major against + # the previous major's data directory within the hour, with the previous + # night's set the only way back. Two names, because Immich's is its own image: the vectorchord + # build's tag moves with both the Postgres major and the extension's, and + # either is a migration Immich documents, not a bump. - package-ecosystem: docker-compose directory: /stacks/sensitive schedule: interval: weekly day: sunday open-pull-requests-limit: 5 + ignore: + - dependency-name: postgres + update-types: ["version-update:semver-major"] + - dependency-name: ghcr.io/immich-app/postgres + update-types: ["version-update:semver-major"] commit-message: prefix: "chore(deps)" labels: ["dependencies", "sensitive"]