Conversation
Detected ecosystems: - npm at "/" - pnpm workspace (pnpm-workspace.yaml covers packages/* and apps/*) with a single pnpm-lock.yaml, so one root entry updates every workspace package. Per-package entries would fight over that one lockfile. - docker at "/docker" - demo-server, facilitator and proxy Dockerfiles, all on a node:26-slim tag. - github-actions at "/" - ci.yml and release.yml, SHA-pinned. Prefixes follow the repo's semantic-release setup, as in chainvue/verus-rpc. Groups follow the peer edges, because a split bump is what actually breaks the build: in peculium-wallet Dependabot bumped vitest and left @vitest/coverage-v8 on the old major, and the peer mismatch took CI down. This repo has both that pair and three more of the same shape: - vitest: vitest, @vitest/*, vite - eslint: eslint, @eslint/*, typescript-eslint, @typescript-eslint/*, globals, typescript - nestjs: @nestjs/* plus reflect-metadata and rxjs, which they peer-depend on - one package moving alone puts the DI container out of step across several workspace packages at once - drizzle-sqlite: drizzle-orm, drizzle-kit, better-sqlite3 and its @types - semantic-release: core, @semantic-release/* and multi-semantic-release typescript majors are ignored for the same reason as in verus-rpc: typescript-eslint's peer range does not admit TS 7, so the PR could not pass lint. Claude-Session: https://claude.ai/code/session_01AxFbkWrzkhDieg5RGm8YdK
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
.github/dependabot.yml. The repo had none.Ecosystems (detected from the tree, with the monorepo layout in mind):
npmat/- pnpm workspace (pnpm-workspace.yaml->packages/*,apps/*) with onepnpm-lock.yaml. A single root entry covers everyworkspace package; per-package entries would contend for the same lockfile.
dockerat/docker-demo-server.Dockerfile,facilitator.Dockerfile,proxy.Dockerfile, allFROM node:26-slim.github-actionsat/- ci.yml, release.yml (SHA-pinned).Style follows chainvue/verus-rpc (same semantic-release angular preset):
weekly,
fix/chore/ciprefixes withinclude: scope. The npm limitis 10 rather than 5 because this is a 16-package workspace.
Why the groups are cut this way. The trigger: in peculium-wallet Dependabot
bumped
vitestand left@vitest/coverage-v8on the old major, and the peermismatch broke CI. Grouping is the only way to force a peer set into one PR, so
every peer family in this repo gets one:
vitest-vitest,@vitest/*,vite(all update types, majorsincluded - the exact case that broke).
eslint-eslint,@eslint/*,typescript-eslint,@typescript-eslint/*,globals,typescript.nestjs-@nestjs/*+reflect-metadata+rxjs. These peer-dependon each other and are spread across facilitator, proxy, mcp, adapter-nestjs
and demo-server; a half-applied major would break all of them at once.
drizzle-sqlite-drizzle-orm,drizzle-kit,better-sqlite3,@types/better-sqlite3(the kit generates against the orm's schema API, andthe types package has to match its runtime).
semantic-release- core,@semantic-release/*,multi-semantic-release.dev-dependencies- everything else dev, minor/patch.Ignore:
typescriptmajors, same gate as verus-rpc (typescript-eslint peerrange
>=4.8.4 <6.1.0as of 8.6x).YAML parses and the keys were checked against the Dependabot schema. One thing
I could not verify from here: Dependabot's Docker file matcher and the
<name>.Dockerfilenaming. If the first run reports no Docker manifests in/docker, that entry is the thing to revisit.https://claude.ai/code/session_01AxFbkWrzkhDieg5RGm8YdK