ppkarwasz commented on PR #699: URL: https://github.com/apache/commons-parent/pull/699#issuecomment-4268154762
> Not true. I've been updating the actions, as you can see the version is current (or should be since I updated them yesterday.) This means a lot of mechanical work for you, so you have less time to tasks that would actually benefit from your expertise. This is the main reason I hate Dependabot churn. > The version checks are quarterly because a person I won't name changed them from `weekly` to `quarterly` in all components because "reasons" about their mailbox. This is a changes I formally voted -1 but I was told my vote didn't count for other "reasons". I fully support that decision for Maven, but we probably didn't discuss it enough for GitHub Actions. These can become deprecated if the GitHub API changes or the Node version they use becomes unsupported, so we have to upgrade them more often. On the other hand if we upgrade carelessly, GitHub Actions and NPM is the heaven of supply-chain attacks. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
