Subject: [pgjdbc/pgjdbc] issue #4099: Configuration suggestion: automerge for `actions/*`, `github/*`, `org.ow2.asm`,

From: "vlsi (@vlsi)" <[email-masked]>
Date: Mon, 25 May 2026 10:40:20 +0000

We have quite a few dependencies, and I believe we can enable automatic merge for certain dependencies provided the tests pass.

For example: `actions/*`, `github/*`. We trust GitHub anyways, so there's nothing to review in `actions/*` changes. Even though the updates are not frequent, even "click-approve" for `actions/checkout` steals maintainers' time.

I have not explored the full list of "trusted dependency vendors", however, even `actions/*` and `github/*` would be helpful.

For GitHub-provided actions, we could even group the updates so Renovate creates a single PR instead of creating separate PRs for `actions/cache` and `actions/setup-java`.

Any thoughts?

---

From: "sehrope (@sehrope)" <[email-masked]>
Date: Tue, 26 May 2026 14:45:56 +0000

I don't want anything automatically being merged. There should always be a manual review step. It's fine to group think together to minimize PR spam and consolidate the updates, but there should always be an actual review in the path. 

If the number of updates is too many to keep up with, maybe we simplify the repo itself. For example in the past 24-hours you have 20+ PRs to update various gradle plugins. And I have no clue what changed in any of them.

A lot of these we don't even need to update. Staying up to date with things is helpful when finally migrating to a new version. But there's no reason we need to be on the bleeding edge for any of these. It's just busy work to keep updating them. If they were working fine and there's no inherent security issue, what did we even gain from updating them so frequently?

---

From: "sehrope (@sehrope)" <[email-masked]>
Date: Tue, 26 May 2026 14:47:29 +0000

For example: https://github.com/pgjdbc/pgjdbc/pull/4107

What changed in these plugin versions and why do we care about bumping to the latest?

---

From: "vlsi (@vlsi)" <[email-masked]>
Date: Tue, 26 May 2026 14:55:05 +0000

For example, https://github.com/vlsi/vlsi-release-plugins/pull/145 was fixed in 3.0.0
Previously, build failure could be printed several times (each subproject printed the same failure exception rather than printing at the end of the build only).

I agree it would be worth to reduce dependencies, however, we can't really avoid `actions/checkout`, and `actions/setup-java`.
What are the concrete review steps you expect to have when updating those?

---

From: "davecramer (@davecramer)" <[email-masked]>
Date: Tue, 26 May 2026 15:25:07 +0000

It seems to me that if the number of reviews are so numerous that we now
want to automate this, then perhaps we have too many dependencies.

Dave Cramer

On Tue, 26 May 2026 at 10:55, Vladimir Sitnikov ***@***.***>
wrote:

> *vlsi* left a comment (pgjdbc/pgjdbc#4099)
> <https://github.com/pgjdbc/pgjdbc/issues/4099#issuecomment-4545301107>
>
> For example, vlsi/vlsi-release-plugins#145
> <https://github.com/vlsi/vlsi-release-plugins/pull/145> was fixed in 3.0.0
> Previously, build failure could be printed several times (each subproject
> printed the same failure exception rather than printing at the end of the
> build only).
>
> I agree it would be worth to reduce dependencies, however, we can't really
> avoid actions/checkout, and actions/setup-java.
> —
> Reply to this email directly, view it on GitHub
> <https://github.com/pgjdbc/pgjdbc/issues/4099?email_source=notifications&email_token=AADDH5W4GG356GTXPMVPVCD44WV6FA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINJUGUZTAMJRGA32M4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSWGM33PORSXEX3DNRUWG2Y#issuecomment-4545301107>,
> or unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AADDH5U2VRY5GDZPF6JNVYD44WV6FAVCNFSM6AAAAACZMCESRKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DKNBVGMYDCMJQG4>
> .
> You are receiving this because you are subscribed to this thread.Message
> ID: ***@***.***>
>

---

From: "vlsi (@vlsi)" <[email-masked]>
Date: Tue, 26 May 2026 15:47:25 +0000

Dave, would you please clarify the way to drop `actions/checkout`, `actions/setup-java`, `actions/upload-artifact`, `actions/github-script`, `actions/deploy-pages`, `actions/configure-pages`, `github/codeql-action/init`, `github/codeql-action/analyze`, `github/codeql-action/upload-sarif` dependencies?

The are test-only dependencies which we need to update sooner or later as well. I do not think we can remove a lot of dependencies.