How should we handle transitive updates?

[armanbilge]

I'd like be mindful of how we provide transitive updates to our downstreams. I suppose this is a versioning question?

E.g. consider:

• Update mdoc, sbt-mdoc to 2.3.0 #112

which didn't pass CI in typelevel/cats#4120.

[rossabaker]

As a first cut, I like to mirror the dependencies:

• patch dep -> patch bump
• minor dep -> minor bump
• major dep -> major bump

Now, some libraries have different ideas of semver, and we might need to "correct" them.

The minor dep (someone else's new features) could just be a patch dep for us... but now we're cornered if our clients can't adopt the minorly bumped dep.

At the end of the day, it's about expressing the right amount of fear and trepidation downstream, but going at least as hard as our most frightened and trepidacious dependency did is a good start.

[armanbilge]

Works for me! (closing as resolved)