Use minimal minor of 3rd-party dependencies #883
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
For framework users, it is actually highly unnecessary—and often counterproductive—to always depend on the latest minor version. This PR reduces dependency versions wherever no newer features are required.
Here is an example:
A project uses MQTT 10.1.x in its application. Now the MQTT driver is released and demands 10.8.x, even though the driver does not use any feature introduced after 10.1.x. As a result, the user is forced to upgrade for no technical reason.
In the MORYX Framework we once had a clear rule: always reference the minimum minor version unless a higher version is explicitly required (for example due to security fixes or new features).
This principle should still apply. I will create an ADR for that.
The same applies to MORYX Drivers and Resources: They should reference 8.0.0 or 10.0.0, but not anything higher unless there is a strong reason such as a security fix or the usage of a new API. This is also one of the reasons I'm not a big fan of placing the MQTT driver and the OPC UA driver inside the monorepo: it becomes too easy for dependencies to drift upwards without justification.
Some reasons:
@jsonBackup Could you adjust the dependabot configuration to this? On Future only propose major updates. Minors/Patches will be grabbed when they are necessary for a feature or after a certain amount of time. For
OPCFoundation.NetStandard.Opc.Ua.Clientonly propose "patch" changes because the third value of the version is used as major for this package.