chore(deps): group npm Dependabot updates + cooldown - #129
Conversation
Group all npm updates in this repo into a single Dependabot PR per run, matching wave-spoke-template's working config, plus a 7-day cooldown on newly published versions.
🤖 CodeAnt AI — Review Status
|
Reviewer's guide (collapsed on small PRs)Reviewer's GuideUpdates the existing npm Dependabot configuration to bundle all dependency bumps into a single PR per scheduled run and wait seven days before proposing newly released versions, reducing lockfile conflicts and allowing newly published releases to stabilize. This is a config-only, forward-looking change; existing dependency PRs and lockfiles are unaffected. Flow diagram for grouped and delayed npm Dependabot updatesflowchart LR
Schedule[Scheduled Dependabot run] --> Cooldown[Wait 7 days for newly published versions]
Cooldown --> Group[Group all npm dependencies]
Group --> PR[Open one dependency update PR]
PR --> Lockfile[Single lockfile rewrite]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
ⓘ Qodo reviews are paused because your workspace is out of credits. Ask your workspace admin to add credits to resume reviews. Manage billing |
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_93dc3994-2cbc-497f-976f-655ce8c3cebf) |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (1)
Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour. 📜 Recent review details⏰ Context from checks skipped due to timeout. (10)
🔇 Additional comments (1)
📝 SummarySummary by CodeRabbit
WalkthroughDependabot now groups npm dependency updates and delays them by seven days. ChangesDependency management
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to npm dependency updates will be grouped into one Dependabot pull request and delayed for seven days after publication. The configuration-only change is ready to merge. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
codeant-ai
Bot
added
the
size:XS
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
Note Automatic reviews are paused because your team has used its included automatic processing for this billing period (headroom scales with your seat count). You can still comment "Gitar review" to run one anytime, and automatic reviews resume on their own by October 1. Add seats for more headroom. Code Review ✅ ApprovedAdds Dependabot grouping and a 7-day cooldown to the npm configuration in OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
|
Failed to generate code suggestions for PR |
ApprovabilityVerdict: Would Approve Macroscope's review found this PR approvable — This is a six-line, self-contained Dependabot configuration change affecting only how and when future npm update pull requests are created. It does not modify SDK runtime behavior, production workflows, dependencies, lockfiles, or deployment configuration. Not approved because:
Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
1 participant
User description
What this does
Adds a
groups:key to the existingnpmupdate entry in.github/dependabot.yml, grouping all npm dependency bumps in this repo into a single Dependabot PR per scheduled run instead of one PR per package. Also adds a 7-daycooldownon newly published versions (waits before proposing a bump to a package that just shipped), matching asemgrepguardrail check that flags configs missing a cooldown.Why
Measured across the wave-av org on 2026-09-07: only 6 of 170 non-archived repos have a
dependabot.ymlat all, and of those, sdk, mcp-server, and adk had a config but nogroups:key — the smallest possible lift on a file that already exists. Org-wide, 61 of 217 open Dependabot PRs (28%) areCONFLICTINGin GitHub's mergeable-state check. Every Dependabot PR rewrites the lockfile, so unrelated single-package PRs are same-hunk-with-each-other by construction — the first one to merge invalidates the lockfile diff in all the others, and ordering can't fix that, only grouping can (bundle the bumps into one lockfile rewrite instead of N races against each other).Grouping is not a hypothesis here — it is already deployed and working in the fleet.
wave-spoke-template's Dependabot config uses this exactgroups: { <name>: { patterns: ["*"] } }shape per ecosystem/directory, and every one of its grouped PRs is clean; its only conflicting PRs predate the groups config being added. This PR models the new block directly on that reference.For this repo specifically at time of writing, the current open Dependabot PRs (#56, #45, #34, #33, #32, #25) are all
MERGEABLE— no pre-existing conflicts to note here, unlike mcp-server and adk which each have liveCONFLICTINGPRs today.What this does NOT do
Grouping is forward-looking only. It changes how future Dependabot runs open PRs; it does not retroactively merge, rebase, or de-conflict any PR that already exists. The six open dependency PRs listed above are untouched by this change and would need to be handled separately (rebase or close) if desired.
Scope
Config-only change to
.github/dependabot.yml. No workflow, dependency, or lockfile changes. Not merging this PR as part of this change — opening for review only.Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.Note
Low Risk
Config-only change to
.github/dependabot.yml; no application code, workflows, or lockfiles are modified.Overview
Updates Dependabot for the root
npmecosystem so future weekly runs open one grouped PR for all dependency bumps (groups.npm-dependencieswith pattern*) instead of separate PRs per package, reducing lockfile merge races.Also adds a 7-day
cooldown(default-days: 7) so Dependabot waits before proposing updates to newly published package versions.Reviewed by Cursor Bugbot for commit b129f88. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by Sourcery
Enhancements:
CodeAnt-AI Description
Group dependency updates and delay newly released versions
What Changed
Impact
✅ Fewer dependency-update pull request conflicts✅ Fewer weekly dependency-update notifications✅ More stable dependency upgrades💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.