Add Dependabot Integration for Cargo packages

[ivinjabraham]

This PR introduces Dependabot to automate dependency updates for patch-hub. Dependabot will check for new versions of dependencies every week and if any are found, it will send a PR to unstable bumping the versions up.

[davidbtadokoro]

Hey, @ivinjabraham, thanks for yet another PR!

I see that dependabot is a great idea. I even think that somewhere (I don't know if it is when releasing new versions) it keeps warning me about a vulnerability regarding the lack of dependabot.

Nevertheless, I am a little skeptical about this approach as I think it can potentially spam the pull-request tab, as there may be many, many version bumps weekly. I am not vetoing the idea, as we need to do chores like this sooner or later, but I don't feel like this is a priority right now...

In any case, I am going to chew a little bit more on the idea, and I will ping you back. Thanks!

[ivinjabraham]

Nevertheless, I am a little skeptical about this approach as I think it can potentially spam the pull-request tab, as there may be many, many version bumps weekly.

Ah great point! I now recall having this annoyance in a previous project. It definitely can create a lot of PRs and IIRC it can even cause conflicts in the lock file. Should I change the interval to be monthly or even bimonthly?

[davidbtadokoro]

@ivinjabraham, thanks for the answer! I thought about longer and think making it monthly is worth the shot. I also added two simple comments, so see if you can address them.

[davidbtadokoro]

Can you explain why we did this here? It seems that groups isn't obligatory. I imagine you are doing it due to version-updates, which my search pointed out doesn't consider "minor" releases like bug fixes. If I am right, maybe we can make the update unrestricted and see if it works.

[davidbtadokoro]

As mentioned in your comment, lets make it monthly and see how it works out.

[davidbtadokoro]

Thanks again! Let's give it a shot and see if it works! The only change I made was to limit the PRs to 10 instead of 1 and the commit message from ci: ... to feat: ... (again, all cataloged in the commit message). I think 10 PRs is a lot, but we should deal with this "chaos" to make patch-hub more stable. I also read that Dependabot keeps a queue of the PRs it couldn't open, so making this number small would only delay the inevitable, right?

Change merged into the unstable branch 👍

[ivinjabraham]

The only change I made was to limit the PRs to 10 instead of 1 [...] I also read that Dependabot keeps a queue of the PRs it couldn't open, so making this number small would only delay the inevitable, right?

I haven't confirmed this in practice, but from what I read, Dependabot automatically updates an existing PR if a new version for the same crate is detected. And since we're grouping all crates into one PR, then I don't think the PR limit changes anything. That's why I made the change from 10 to 1.

[davidbtadokoro]

I haven't confirmed this in practice, but from what I read, Dependabot automatically updates an existing PR if a new version for the same crate is detected. And since we're grouping all crates into one PR, then I don't think the PR limit changes anything. That's why I made the change from 10 to 1.

Oh, my bad! I didn't know about this! I will make a PR fixing this. Thanks for the heads-up!