From bdf0b3831fe01c1a368513181d9518887d7f15fb Mon Sep 17 00:00:00 2001 From: arengia Date: Sun, 2 Aug 2026 06:57:09 +0200 Subject: [PATCH] ci: give major version updates their own Dependabot group The previous config grouped only minor and patch updates, which is a partial bundle rather than a bundle: everything outside the group still arrives as one pull request per package. Its first run showed exactly that, opening five separate major version PRs next to the grouped one, which is the pull request stream the grouping was meant to prevent. Major updates now go into their own group, so a routine month produces at most two npm pull requests instead of one plus however many majors happen to be due. They are grouped rather than ignored on purpose. Ignoring major versions would also suppress security updates that can only be resolved by a major upgrade, which would defeat the point of this file. Keeping them in a separate group from minor and patch means a breaking major upgrade cannot block the routine updates from being merged, which already matters here: the Tailwind 3 to 4 PR fails CI while every other update passes. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index adee7ab..f3dabb7 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -2,13 +2,26 @@ version: 2 # This repository is maintained on a best effort basis (see README), so the goal # here is a small number of reviewable pull requests rather than a constant -# stream of them. Minor and patch updates are therefore grouped into a single -# monthly PR per ecosystem. Security updates are unaffected by this schedule: +# stream of them. Security updates are unaffected by the schedule below: # Dependabot still opens those as soon as an advisory lands. # +# Every update type is assigned to a group on purpose. A group that only lists +# `minor` and `patch` is not a bundle, it is a partial bundle: whatever falls +# outside it still arrives as one pull request per package. The first run of +# this config demonstrated that by opening five separate major version PRs +# alongside the grouped one. +# +# Major versions get their own group rather than being ignored. Ignoring them +# would also suppress security updates that can only be resolved by a major +# upgrade, which is the opposite of what this file is for. Keeping them apart +# from the minor and patch group means a breaking major upgrade cannot block +# the routine updates from being merged. +# # CI (.github/workflows/ci.yml) builds every PR and runs scripts/smoke-e2e.sh # against a real server, including a real Puppeteer PDF export, so a dependency -# PR that breaks the app fails visibly before it can be merged. +# PR that breaks the app fails visibly before it can be merged. Note that a +# green smoke test is evidence, not a guarantee: it exercises the main flows, +# not every API a major upgrade may have changed. updates: - package-ecosystem: npm directory: / @@ -22,6 +35,11 @@ updates: update-types: - minor - patch + npm-major: + patterns: + - '*' + update-types: + - major - package-ecosystem: github-actions directory: /