From 72da503f444be2b371d6035745d82a918534e916 Mon Sep 17 00:00:00 2001 From: Kevin Liu Date: Sun, 6 Sep 2026 09:58:11 -0700 Subject: [PATCH 1/4] Infra: Switch Dependabot to a monthly cadence Weekly Dependabot runs produce roughly 11 PRs a week, close to half of all PRs in the repository. Dependency bumps only need to land before a release, so run monthly and document a manual Dependabot check in the release guide. Co-Authored-By: Claude Fable 5.1 --- .github/dependabot.yml | 4 ++-- mkdocs/docs/how-to-release.md | 4 ++++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 08b6362978..cf5b9777bf 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -22,7 +22,7 @@ updates: - package-ecosystem: "uv" directory: "/" schedule: - interval: "weekly" + interval: "monthly" open-pull-requests-limit: 50 ignore: - dependency-name: "datafusion" @@ -31,7 +31,7 @@ updates: - package-ecosystem: "github-actions" directory: "/" schedule: - interval: "weekly" + interval: "monthly" cooldown: default-days: 7 groups: diff --git a/mkdocs/docs/how-to-release.md b/mkdocs/docs/how-to-release.md index b6fd545311..97f172a5ed 100644 --- a/mkdocs/docs/how-to-release.md +++ b/mkdocs/docs/how-to-release.md @@ -65,6 +65,10 @@ deprecation_message( ) ``` +### Update Dependencies + +Dependabot runs monthly to keep the noise down, so the pinned dependencies in `uv.lock` may be stale by the time of a release. Before cutting the release candidate, go to the [Dependabot page](https://github.com/apache/iceberg-python/network/updates) in the repository's Insights tab and trigger a manual check for both the `uv` and `github-actions` ecosystems. Review and merge the resulting PRs so the release ships with up-to-date dependencies. + ### Update Library Version Update the release version by running `uv version `, which updates both `pyproject.toml` and `uv.lock`. Then update the version in `pyiceberg/__init__.py` to match. From 6f3b66d0b965dfb5add4740ee3bfbfb8cb92f968 Mon Sep 17 00:00:00 2001 From: Kevin Liu Date: Sun, 6 Sep 2026 09:59:55 -0700 Subject: [PATCH 2/4] Docs: Note that triggering Dependabot requires committer access Co-Authored-By: Claude Fable 5.1 --- mkdocs/docs/how-to-release.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/mkdocs/docs/how-to-release.md b/mkdocs/docs/how-to-release.md index 97f172a5ed..2bec400778 100644 --- a/mkdocs/docs/how-to-release.md +++ b/mkdocs/docs/how-to-release.md @@ -34,6 +34,8 @@ This guide outlines the process for releasing PyIceberg in accordance with the [ * SVN Access * Permission to upload artifacts to the [Apache development distribution](https://dist.apache.org/repos/dist/dev/iceberg/) (requires Apache Committer access). * Permission to upload artifacts to the [Apache release distribution](https://dist.apache.org/repos/dist/release/iceberg/) (requires Apache PMC access). +* GitHub Access + * Write access to the [apache/iceberg-python](https://github.com/apache/iceberg-python) repository for triggering Dependabot (requires Apache Committer access). * PyPI Access * The `twine` package must be installed for uploading releases to PyPi. * A PyPI account with publishing permissions for the [pyiceberg project](https://pypi.org/project/pyiceberg/). @@ -69,6 +71,13 @@ deprecation_message( Dependabot runs monthly to keep the noise down, so the pinned dependencies in `uv.lock` may be stale by the time of a release. Before cutting the release candidate, go to the [Dependabot page](https://github.com/apache/iceberg-python/network/updates) in the repository's Insights tab and trigger a manual check for both the `uv` and `github-actions` ecosystems. Review and merge the resulting PRs so the release ships with up-to-date dependencies. + + +!!! note + Only a committer with write access to the repository can trigger Dependabot manually. Please work with a committer if you do not have write access. + + + ### Update Library Version Update the release version by running `uv version `, which updates both `pyproject.toml` and `uv.lock`. Then update the version in `pyiceberg/__init__.py` to match. From 35797b06422aee3e4e5c2d4553a828f7956a7817 Mon Sep 17 00:00:00 2001 From: Kevin Liu Date: Sun, 6 Sep 2026 10:02:23 -0700 Subject: [PATCH 3/4] Docs: Replace Dependabot Insights link that returns 404 without write access Co-Authored-By: Claude Fable 5.1 --- mkdocs/docs/how-to-release.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mkdocs/docs/how-to-release.md b/mkdocs/docs/how-to-release.md index 2bec400778..0f0c7676b3 100644 --- a/mkdocs/docs/how-to-release.md +++ b/mkdocs/docs/how-to-release.md @@ -69,7 +69,7 @@ deprecation_message( ### Update Dependencies -Dependabot runs monthly to keep the noise down, so the pinned dependencies in `uv.lock` may be stale by the time of a release. Before cutting the release candidate, go to the [Dependabot page](https://github.com/apache/iceberg-python/network/updates) in the repository's Insights tab and trigger a manual check for both the `uv` and `github-actions` ecosystems. Review and merge the resulting PRs so the release ships with up-to-date dependencies. +Dependabot runs monthly to keep the noise down, so the pinned dependencies in `uv.lock` may be stale by the time of a release. Before cutting the release candidate, open the repository's **Insights** tab, select **Dependabot**, and trigger a manual check for both the `uv` and `github-actions` ecosystems. Review and merge the resulting PRs so the release ships with up-to-date dependencies. See the [GitHub documentation](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/listing-dependencies-configured-for-version-updates) for details. From 65f1aa33f78bf87dca2bc1e1125ac03796a25b59 Mon Sep 17 00:00:00 2001 From: Kevin Liu Date: Sun, 6 Sep 2026 10:05:32 -0700 Subject: [PATCH 4/4] Docs: Restore Dependabot Insights link and skip it in markdown-link-check The page returns 404 without write access, so the link checker cannot verify it. Co-Authored-By: Claude Fable 5.1 --- mkdocs/docs/how-to-release.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mkdocs/docs/how-to-release.md b/mkdocs/docs/how-to-release.md index 0f0c7676b3..982447d259 100644 --- a/mkdocs/docs/how-to-release.md +++ b/mkdocs/docs/how-to-release.md @@ -69,7 +69,8 @@ deprecation_message( ### Update Dependencies -Dependabot runs monthly to keep the noise down, so the pinned dependencies in `uv.lock` may be stale by the time of a release. Before cutting the release candidate, open the repository's **Insights** tab, select **Dependabot**, and trigger a manual check for both the `uv` and `github-actions` ecosystems. Review and merge the resulting PRs so the release ships with up-to-date dependencies. See the [GitHub documentation](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/listing-dependencies-configured-for-version-updates) for details. + +Dependabot runs monthly to keep the noise down, so the pinned dependencies in `uv.lock` may be stale by the time of a release. Before cutting the release candidate, go to the [Dependabot page](https://github.com/apache/iceberg-python/network/updates) in the repository's Insights tab and trigger a manual check for both the `uv` and `github-actions` ecosystems. Review and merge the resulting PRs so the release ships with up-to-date dependencies.