what is the policy for dependency upgrade?

[wnwaynelee]

Hi, I noticed some dependencies in 3.6 and 3.7 are older than the ones in 3.5.

	3.5	3.6	3.7
golang.org/x/crypto	v0.53.0	v0.52.0	v0.52.0
golang.org/x/net	v0.56.0	v0.55.0	v0.55.0
golang.org/x/sys	v0.46.0	v0.45.0	v0.45.0
golang.org/x/text	v0.39.0	v0.37.0	v0.37.0

What is the policy for dependency upgrade?

Thanks.

[aniketatgithub]

This is documented in the repo, in Documentation/contributor-guide/dependency_management.md. The short version:

On the main branch, Dependabot is enabled and opens dependency bump PRs on a weekly schedule. Because etcd is a multi-module repo, those PRs usually need human intervention before they can land, and there is a documented bumping order across the modules.

Stable branches work differently. The documented policy is that dependencies are not proactively bumped for stable releases unless there is a CVE or a bug that affects etcd. So each stable branch only gets the bumps it actually needs, when it needs them. That is why the versions are not in sync across branches, and why an older branch can occasionally sit on a newer version of some library than a newer branch, if that older branch needed a security fix that the newer branch did not.

So there is no step that syncs dependency versions across the branches. If you spot a dependency in a stable branch that has a known CVE, pointing it out is the kind of thing that triggers a bump there.