Make 'chore(deps)' commits trigger releases #180

Activity

1. b-long

   added

   help wantedExtra attention is neededExtra attention is needed

   good first issueGood for newcomersGood for newcomers

   on Sep 15, 2026
2. UsmanGhias commented on Sep 15, 2026

   

   UsmanGhias

   on Sep 15, 2026

   More actions

   Hey there! This is a really important catch, especially since dependency updates often contain critical security patches that need to go out to users right away. You are completely right to want CVE fixes published immediately rather than waiting for a feature PR.

   By default, popular release automation tools like release-please ignore chore commits because they are usually meant for internal maintenance tasks, documentation tweaks, or routine dependency bumps that do not affect the public API. Since chore(deps) starts with chore, the tool assumes it should skip bumping the version and generating a release.

   The fix is usually as simple as updating your release-please configuration file (typically release-please-config.json or .release-please-config.json at the root of your repository) to treat dependency updates as patches or fixes that trigger a release. Here is an example of how you can map chore or specific dependency scopes so they bump the patch version:

   {
     "packages": {
       ".": {
         "release-type": "python",
         "package-name": "opentdf-python-sdk",
         "changelog-types": {
           "feat": "Features",
           "fix": "Bug Fixes",
           "chore": "Miscellaneous"
         },
         "extra-files": [],
         "pull-request-title-pattern": "chore${scope}: release${version}",
         "include-component-in-tag": false
       }
     },
     "release-types": {
       "python": {
         "component": "python"
       }
     }
   }

   Depending on the exact version of the release-please action you are using in your workflow files, you might also want to check if you can pass a custom release mapping. If you are using a standard manifest file (release-please-manifest.json), ensure that your configuration explicitly allows chore types to map to patch increments by defining a custom commit-types block if your version supports it.

   A great way to test this without spamming your actual repository is to trigger a workflow run on a test branch, or check the release-please action logs in dry-run mode. This lets you preview exactly which commits are being evaluated and whether they successfully trigger the planned version bump before merging anything to main.

   Hope this helps point you in the right direction! Let me know if you run into any issues.

   Best,
   Usman