Add Package.resolved and dependabot.yml

[incertum]

Add Package.resolved and dependabot.yml

[FranzBusch]

I don't think that we should go ahead with this PR. The recommendation right now is to not commit the resolved file in libraries since the file has no impact on users of the package. Furthermore, libraries should avoid bumping the min versions unless there is a need for it e.g. new APIs available in a dependency.

[incertum]

I don't think that we should go ahead with this PR. The recommendation right now is to not commit the resolved file in libraries since the file has no impact on users of the package. Furthermore, libraries should avoid bumping the min versions unless there is a need for it e.g. new APIs available in a dependency.

There is a bigger discussion ongoing around this. Let's move this PR to draft state until there are new features or a new decision / outcome in this regard.

[ktoso]

Yeah, it is not useful to have a Package.resolved in libraries.

Package.resolved isn't a real lock file; it doesn't matter at all in libraries either since consumer will just resolve anyway.

[incertum]

Yeah, it is not useful to have a Package.resolved in libraries.

Package.resolved isn't a real lock file; it doesn't matter at all in libraries either since consumer will just resolve anyway.

ACK. Hoping this changes in the future and there will be new features allowing honoring a library’s real lock file (aligning with security best practices :)).

[ktoso]

I don't think we should do this in libraries