ci: give major version updates their own Dependabot group - #8
Merged
Conversation
The previous config grouped only minor and patch updates, which is a partial bundle rather than a bundle: everything outside the group still arrives as one pull request per package. Its first run showed exactly that, opening five separate major version PRs next to the grouped one, which is the pull request stream the grouping was meant to prevent. Major updates now go into their own group, so a routine month produces at most two npm pull requests instead of one plus however many majors happen to be due. They are grouped rather than ignored on purpose. Ignoring major versions would also suppress security updates that can only be resolved by a major upgrade, which would defeat the point of this file. Keeping them in a separate group from minor and patch means a breaking major upgrade cannot block the routine updates from being merged, which already matters here: the Tailwind 3 to 4 PR fails CI while every other update passes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #1, fixing a flaw in the Dependabot config that PR introduced.
The problem
The config grouped only
minorandpatchupdates. That is a partial bundle rather than a bundle: anything outside the group still arrives as one pull request per package. Its very first run demonstrated this by opening five separate major version PRs (#2, #3, #4, #6, #7) alongside the grouped one, which is precisely the pull request stream the grouping was supposed to prevent.The
github-actionsentry did not have this problem, because it declares noupdate-typesat all and therefore groups everything. That contrast is what made the cause obvious: #5 bundled seven action updates into a single PR.The fix
Major updates get their own group. A routine month now produces at most two npm pull requests instead of one plus however many majors happen to be due.
They are grouped rather than ignored, deliberately.
ignorewithversion-update:semver-majoris the shorter fix and the wrong one: Dependabot security updates honour ignore rules too, so a vulnerability that can only be resolved by a major upgrade would silently never reach the repository. That is the failure mode this config exists to prevent.Keeping majors in a group separate from minor and patch also means a breaking upgrade cannot hold the routine updates hostage. That already matters here: #4 (Tailwind 3 to 4) fails CI while every other open update passes.
Note for whoever reviews the open major PRs
CI passing on a major upgrade is evidence, not a guarantee. The smoke test exercises the main flows end to end, including a real PDF export, but it does not touch every API a major version may have changed. #6 (csv-parse 7) and #7 (better-sqlite3 13) deserve a look at their changelogs before merging, green checks notwithstanding.
🤖 Generated with Claude Code