Dependency updates for Cargo and npm manifests (Diffusion beyond Oxygen pins) issue #270
open andymccall opened this · 0 comments
andymccall
From the competitor comparison (2026-10-19): Dependabot (GitHub) and Renovate (GitLab, Codeberg) open update proposals for package manifests; Diffusion (issue #148) does this only for Oxygen subrepo pins.
Goal: Diffusion for Cargo.toml/Cargo.lock and package.json/package-lock.json (then others): when a dependency publishes a new version, the hub opens a proposal bumping it, with release notes, and the pipeline's checks on the projected state.
Reuse Diffusion's machinery: the diffusion account, diffusion/… bookmarks, grouping, landing rules (auto-land when checks pass, issue #261).
Security updates first: advisories (RustSec, GitHub Advisory Database/OSV) raise a proposal regardless of schedule, labelled security.
Lockfile-only updates vs manifest range bumps; per-repository schedule and ignore rules in a .oxygenhub/updates.kdl.
Needs network access to registries from the hub (not from jobs, which stay offline): the bump job vendors what it needs.
From the competitor comparison (2026-10-19): Dependabot (GitHub) and Renovate (GitLab, Codeberg) open update proposals for package manifests; Diffusion (issue #148) does this only for Oxygen subrepo pins.
Goal: Diffusion for Cargo.toml/Cargo.lock and package.json/package-lock.json (then others): when a dependency publishes a new version, the hub opens a proposal bumping it, with release notes, and the pipeline's checks on the projected state.
diffusionaccount,diffusion/…bookmarks, grouping, landing rules (auto-land when checks pass, issue #261).security..oxygenhub/updates.kdl.