From 9345a0966584ca33e743842789c4f862da4fe6c0 Mon Sep 17 00:00:00 2001 From: kaseywright Date: Thu, 27 Aug 2026 15:33:00 -0400 Subject: [PATCH 1/2] ci: add the npm ecosystem to Dependabot config Until now this file configured github-actions only. That did not stop npm bumps from arriving, because Dependabot security updates run off the alert feed and ignore dependabot.yml -- every npm pull request this repo has seen came in that way. Three consequences, all of which we hit: * no routine version updates, so npm dependencies only moved when an advisory forced them; * one pull request per advisory, ungrouped and with no cooldown, which is the sprawl the github-actions groups already exist to prevent; * `@dependabot rebase` fails on those pull requests -- it looks for the ecosystem entry, finds none, and reports it "has been deleted", directing you to close the pull request. Closing it registers the release as declined and Dependabot stops offering that fix. That is how the axios and better-auth advisories ended up with no open pull request. Minor and patch are grouped, split production from development. Majors stay ungrouped so each arrives with its own changelog to read. `versioning-strategy: increase` preserves the exact-pin convention in package.json. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01JrPR3vYA5DwEwTiE4E2aJn --- .github/dependabot.yml | 55 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6bc098dd..1e3261a1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -30,3 +30,58 @@ updates: - dependencies commit-message: prefix: build(deps) + + # The npm ecosystem had no entry here until now, which did not stop npm + # bumps from arriving -- Dependabot security updates run off the alert feed + # and ignore this file entirely. Every npm pull request this repo has ever + # seen came in that way. The cost was invisible until it wasn't: + # + # * no routine version updates at all, so dependencies only ever moved + # when an advisory forced them; + # * one pull request per advisory, ungrouped and without the cooldown + # above, which is the same sprawl the github-actions groups exist to + # prevent; + # * `@dependabot rebase` fails on those pull requests. The rebase path + # looks for the ecosystem's entry in this file, does not find one, and + # reports that the entry "has been deleted" -- which sends you to close + # a perfectly good pull request. Closing it teaches Dependabot the + # release was declined and it stops offering that fix, which is how the + # axios and better-auth advisories ended up with no open pull request. + - package-ecosystem: npm + directory: / + schedule: + interval: daily + cooldown: + default-days: 7 + open-pull-requests-limit: 5 + # package.json pins direct dependencies exactly. `increase` bumps the pin + # itself rather than widening it to a range, so that convention survives + # contact with Dependabot. + versioning-strategy: increase + groups: + # Minor and patch only. Majors are deliberately left ungrouped so each + # one arrives as its own pull request with its own changelog to read. + npm-production: + applies-to: version-updates + dependency-type: production + update-types: + - minor + - patch + npm-development: + applies-to: version-updates + dependency-type: development + update-types: + - minor + - patch + # Same reasoning as github-actions-security above: advisories arrive as + # a separate update type and default to a pull request each. + npm-security: + applies-to: security-updates + patterns: + - '*' + labels: + - dependencies + - javascript + commit-message: + prefix: build(deps) + prefix-development: build(deps-dev) From 6429d48b5c3527bda9a3746568db55bf2e2b7186 Mon Sep 17 00:00:00 2001 From: kaseywright Date: Thu, 27 Aug 2026 15:42:03 -0400 Subject: [PATCH 2/2] ci: correct the versioning-strategy comment The comment claimed package.json pins direct dependencies exactly and that `increase` preserves that convention. Eight of the 41 direct dependencies use caret ranges (@aws-sdk/*, better-auth and its plugins, bcryptjs, @types/bcryptjs), and `increase` cannot convert a range into a pin -- it bumps the minimum of whatever specification is already there. The setting stays: it is still what keeps an exact pin exact instead of widening it. Only the claim about what it enforces was wrong. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01JrPR3vYA5DwEwTiE4E2aJn --- .github/dependabot.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1e3261a1..e173a733 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -54,9 +54,12 @@ updates: cooldown: default-days: 7 open-pull-requests-limit: 5 - # package.json pins direct dependencies exactly. `increase` bumps the pin - # itself rather than widening it to a range, so that convention survives - # contact with Dependabot. + # Bump the minimum of whatever specification already exists, rather than + # widening it into a range. An exact pin stays exact -- which is most of + # package.json -- and the handful of caret ranges (@aws-sdk/*, better-auth, + # bcryptjs) keep their caret at a higher floor. This does not convert a + # range into a pin: tightening those is a package.json edit, not something + # a Dependabot setting can do. versioning-strategy: increase groups: # Minor and patch only. Majors are deliberately left ungrouped so each