build(deps): Bump the docker-compose-images group in /release/conformance/openid with 2 updates#376
Conversation
Bumps the docker-compose-images group in /release/conformance/openid with 2 updates: maven and mongo. Updates `maven` from 3-eclipse-temurin-21 to 3-eclipse-temurin-26 Updates `mongo` from 6.0.13 to 8.2.11 --- updated-dependencies: - dependency-name: maven dependency-version: 3-eclipse-temurin-26 dependency-type: direct:production dependency-group: docker-compose-images - dependency-name: mongo dependency-version: 8.2.11 dependency-type: direct:production update-type: version-update:semver-major dependency-group: docker-compose-images ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b4b83a30a6
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| services: | ||
| builder: | ||
| image: maven:3-eclipse-temurin-21@sha256:2b4496088e7b80ae10a8c9f74e574ea21380325a006ec684532ad6bad5bc7273 | ||
| image: maven:3-eclipse-temurin-26@sha256:d5617b9a6307e1b51dc7c55edf09bacb66f1c91fb861949c34a3a0d4e16bd241 |
There was a problem hiding this comment.
With this image changed to maven:3-eclipse-temurin-26, the documented release check python3 -m unittest release/scripts/test_openid_conformance_runner.py now fails because release/scripts/test_openid_conformance_runner.py:69 still asserts that the builder override contains maven:3-eclipse-temurin-21@sha256:. This leaves the release/conformance gate red for this dependency bump; update the test's reviewed pin expectation alongside the image or keep the Maven pin at 21.
Useful? React with 👍 / 👎.
| services: | ||
| mongodb: | ||
| image: mongo:6.0.13@sha256:b415b12f638e2685d06c58ab7fb5943577c50fadec6d9340ef67d21aeac72070 | ||
| image: mongo:8.2.11@sha256:951c2ff9fc6bdb6cb89b1dfea4a0e8ae3ee4fb287c0bf579b2bba54c7803f75d |
There was a problem hiding this comment.
When a developer has already run the conformance suite with the previous mongo:6.0.13 pin, the pinned upstream compose bind-mounts ./mongo/data:/data/db under the reused suite checkout, so this direct jump to Mongo 8.2 will try to open persisted 6.0 files. MongoDB's 8.0 standalone upgrade guide says a 6.0-series deployment must upgrade to 7.0 before 8.0 (https://www.mongodb.com/docs/manual/release-notes/8.0-upgrade-standalone/#upgrade-version-path), so openid-conformance-runner.py up can fail for existing workspaces unless the runner purges/renames the old data directory or the bump is staged through a compatible upgrade path.
Useful? React with 👍 / 👎.
Bumps the docker-compose-images group in /release/conformance/openid with 2 updates: maven and mongo.
Updates
mavenfrom 3-eclipse-temurin-21 to 3-eclipse-temurin-26Updates
mongofrom 6.0.13 to 8.2.11Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions