Issues with GitHub's dependabot + NPM versions. dependabot is insisting on using NPM version 11 when creating it's dependency PRs. This results in a "package-lock.json" that works for NPM 11, but is (seemingly) incompatible with NPM 10. Since NPM 10 is the default for Node.js 20 and 22, this causes immediately errors in our GitHub automated tests...as they fail to run "npm install" using the "package-lock.json" built via NPM 11.
To quickly find PRs assigned to you for review, visit https://github.com/pulls/review-requested (This is also available in the GitHub header under "Pull Requests → Review Requests")
Deadline is TBD for 9.2, 8.3 and7.6.5. Bug fix releases do not have fixed/scheduled deadlines.Instead, the developer team will determine when to create a release based on the significance of the issues to solve. (e.g. If major issues are fixed, then a bug fix release will occur more rapidly. If minor issues are found, then a bug fix release may be delayed until sufficient fixes have been made to warrant a release)
Bug/security fixes only. These minor releases will not include any new features.
New "themeable components" (for dspace-angular) are allowed in bug fix releases, provided that they don't significantly modify component behavior or similar.
Accessibility fixes are also allowed in bug fix releases, provided they don't significantly modify component behavior or similar.
Bug fix PRsshould be created against "main" branch where possible. The "main" branch has the most strict code style rules. (i.e. PRs created against dspace-7_x are becoming more difficult to port forward.)
Per our support policy, bug fixes are only guaranteed to be ported back to 9.x. That said, where possible, we'll try to backport bug fixes (especially significant ones) to 8. x and 7.6.x.
Try "Pull Request Trading" for a quicker review
Do you have a PR stuck in "under review" that you really want to see move forward? Or maybe it's someone else's PR but you want to get it more attention?