chore(deps): ignore two majors Dependabot cannot land safely - #334
Merged
Conversation
Both of these open weekly, go green, and are not mergeable. Green CI is misleading in each case because the thing that breaks is not in CI. eslint 10 (#333): eslint-config-next 16.3.3 (latest) still depends on eslint-plugin-react ^7.37.0, and the newest eslint-plugin-react (7.37.5) declares peer eslint "^9.7". Under eslint 10 it throws "TypeError: Error while loading rule 'react/display-name': contextOrFilename.getFilename is not a function" on every file in both apps — linting does not run at all. eslint-config-next's own peer range is >=9.0.0, so pnpm installs it cleanly and the failure only appears at lint time; lint is deliberately not in CI, so the PR reports green. Verified locally against the PR branch on 2026-08-31. tauri-action v1 (#328): release.yml only runs on pushes to `release`, so this action is never exercised by a PR — a bad bump surfaces in the middle of a real ~200-minute signed macOS release. v1 removes `updaterJsonKeepUniversal` and switches latest.json asset URLs to GitHub API URLs, whose embedded asset IDs belong to this repo; the mirror step rewrites URLs by string-replacing the repo slug, so those would survive the rewrite pointing at assets that do not exist in the mirror repo. Both ignores are scoped to majors and carry the condition for removal. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This was referenced Aug 31, 2026
ThreatCrush Security Scan1 finding(s) MEDIUM: 1
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the loop on the two dependency PRs that report green but are not mergeable. In both cases CI is green because the thing that breaks is not covered by CI.
eslint 10 — #333
eslint-config-next@16.3.3(latest) still depends oneslint-plugin-react@^7.37.0, and the newesteslint-plugin-react(7.37.5) declares peereslint: "^9.7". Under eslint 10 it crashes on every file, in bothapps/desktop-uiandapps/web:Exit code 2 — linting does not run at all, this is not a lint-error backlog.
eslint-config-nextdeclares its own peer range as>=9.0.0, so pnpm resolves and installs without complaint and the failure only appears at lint time. Lint is deliberately not in CI, so the PR goes green.No override fixes this — 7.37.5 is the latest release and no eslint 10 compatible version exists yet. Verified locally against the PR branch on 2026-08-31.
Remove this ignore when
eslint-plugin-reactships eslint 10 support.tauri-action v1 — #328
release.ymlonly runs on pushes torelease, sotauri-apps/tauri-actionis never exercised by a PR. A bad bump surfaces in the middle of a real ~200-billed-minute signed macOS release. v1 is breaking in two ways that touch this workflow:updaterJsonKeepUniversalis removed (now always on).latest.jsonasset URLs move from browser-download URLs to GitHub API URLs, which embed an asset ID belonging to this repo. The mirror step repoints URLs by string-replacing the repo slug, so an API URL survives the rewrite while referencing an asset ID that does not exist in the mirror repo — silently breaking updates for installs still polling it.The six other bumps in #328 are all exercised by that PR own CI and are fine; I pushed a commit there holding only
tauri-actionat v0.Remove this ignore when the v1 migration has been done by hand and tested against a throwaway tag.
Both ignores are scoped to majors, so minor and patch updates still flow.
🤖 Generated with Claude Code