kevinjqliu opened a new pull request, #3216: URL: https://github.com/apache/iceberg-rust/pull/3216
## Which issue does this PR close? N/A. ## What changes are included in this PR? Follow the [monthly-cadence change in PyIceberg](https://redirect.github.com/apache/iceberg-python/pull/3914). ### Rationale Weekly Dependabot runs generate recurring review and CI work. Over the last 12 complete months, **2025-09-13 through 2026-09-12 (inclusive, UTC)**: | Metric | Value | |---|---:| | Dependabot PRs | 252 | | All PRs in the repo | 1,119 | | Share of PRs from Dependabot | 22.5% | | Average Dependabot PRs per week | ~5 | | Average Dependabot PRs per month | 21 | Sources: GitHub Search API counts for [Dependabot PRs](https://github.com/apache/iceberg-rust/pulls?q=is%3Apr+created%3A2025-09-13..2026-09-12+author%3Aapp%2Fdependabot) and [all PRs](https://github.com/apache/iceberg-rust/pulls?q=is%3Apr+created%3A2025-09-13..2026-09-12), including all PR states. Both queries returned `incomplete_results: false`. Weekly averages use the 365-day window; monthly averages divide by 12. Dependabot counts include both version and security update PRs, so these numbers describe historical bot volume, not a forecast of PRs eliminated. Monthly version checks should reduce repeated routine bumps, while an explicit pre-release check lets release managers refresh dependencies when needed. [Dependabot security updates are not governed by this schedule](https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#schedule-). ### Changes - Change `cargo`, `github-actions`, and Python bindings `uv` schedules from `weekly` to `monthly`. - Remove `day: sunday`, which only applies to weekly schedules. Monthly checks run on the first day of each month. - Preserve cooldowns, ignore rules, grouping, the Cargo PR limit, and the `lockfile-only` versioning strategy. - Add an "Update dependencies" step to the release guide before release branch creation and version bumps. It covers manually checking all three ecosystems, reviewing and merging applicable updates, backporting to an existing release branch, regenerating dependency lists, and the required write access. ## Are these changes tested? Parsed the Dependabot YAML and verified that all three schedules are monthly and all other configuration values are unchanged. `git diff --check` passes. No Rust runtime code changes; CI was not awaited. ## AI Disclosure Implemented with GitHub Copilot. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
