Dependabot

We recommend to source your modules using a major version (e.g. v4), but we also publish minor and patch version updates. The major version tag is updated to point at the latest version in that major release. We also have a latest tag if you wish to use that.

By default, Dependabot will update your dependencies to the latest minor/patch version, which is not necessary here because of the floating major version tags. To prevent Dependabot from updating these dependencies, use the following config:

version: 2
updates:
  - package-ecosystem: terraform
    directory: /
    schedule:
      interval: daily
    ignore:
      - dependency-name: "*"
        update-types:
          - "version-update:semver-patch"
          - "version-update:semver-minor"