chore(ci): give version updates to Renovate, keep Dependabot for security - #141
Merged
Conversation
…rity #125 enabled Dependabot alongside Renovate deliberately and temporarily, to compare the two on the same manifests before settling on one. One cycle answered it. Volume -- identical coverage, roughly half the review surface: work Renovate Dependabot npm minor/patch #128 #131 npm majors #130 #132 #133 #135 #136 actions minor #123 #137 actions majors #129 #138 #139 TOTAL 4 PRs 8 PRs Engine awareness -- the decisive one. Renovate reads engines.node and .nvmrc and filters candidates against them via constraintsFiltering. Dependabot has no equivalent at any level: its ignore/allow/versioning-strategy/groups levers all operate on semver update *type*, never on runtime compatibility. That is not theoretical. Dependabot opened #134 proposing @types/node 26 against a Node 24 runtime -- precisely the typings-ahead-of-runtime drift issue #126 exists to prevent -- while Renovate, from the same repository state, did not. Constraining Dependabot required a hand-written per-package ignore rule, which would then have to be maintained for every future dependency carrying an engines constraint. That does not scale, and forgetting one fails silently. A pin is only as strong as the automation that respects it, so version updates go to the tool that can see it. Sets open-pull-requests-limit to 0 for both ecosystems rather than deleting the file: it stops version updates while leaving the per-ecosystem settings available to security updates, and re-enabling is a one-line revert. Dependabot SECURITY updates are untouched. They are a repository setting, not this file, and they stay ON -- Dependabot is the better of the two at alert-driven security PRs, and it is what surfaced the advisories cleared in cc5b257. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe Dependabot configuration disables npm and GitHub Actions version-update pull requests. Renovate now owns version updates. Dependabot security updates remain enabled. Obsolete grouping and ChangesDependency update ownership
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
thewrz
marked this pull request as ready for review
August 2, 2026 05:44
Collaborator
Author
|
@coderabbitai full review |
✅ Action performedFull review finished. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This was written agentically; verify its assertions and edit accordingly:
Why
#125 turned Dependabot on alongside Renovate deliberately and temporarily — its own words were "expect duplicate PRs until then; that is intentional, not a misconfiguration" — so the two could be compared on the same manifests before settling on one. One cycle produced a clear answer.
1. Volume — identical coverage, roughly half the review surface
2. Engine awareness — the decisive one
Renovate reads
engines.nodeand.nvmrcand filters candidate versions against them (constraintsFiltering: "strict", already inrenovate.jsonas of #127). Dependabot has no equivalent at any level — itsignore/allow/versioning-strategy/groupslevers all operate on semver update type, never on runtime compatibility.That is not a theoretical gap. Dependabot opened #134 proposing
@types/node26 against a Node 24 runtime — the exact typings-ahead-of-runtime drift #126 exists to prevent — while Renovate, from the identical repository state, did not. Constraining Dependabot took a hand-written per-packageignorerule, which would then need maintaining for every future dependency carrying an engines constraint. That does not scale, and forgetting one fails silently.A pin is only as strong as the automation that respects it, so version updates go to the tool that can actually see it.
What
Sets
open-pull-requests-limit: 0on both ecosystems in.github/dependabot.yml.The file is kept, not deleted, on purpose.
0stops version updates while leaving the per-ecosystem settings available to Dependabot's security updates, and re-enabling is a one-line revert rather than a reconstruction. The removedgroupsandignoreblocks were only meaningful for version updates.They are a repository setting (Settings → Code security → Dependabot security updates), not this file. This PR does not touch them and they should stay ON — Dependabot is the better of the two at alert-driven security PRs, and it is what surfaced the six advisories cleared in
cc5b257.Worth confirming that setting is still enabled after merge, since that is the half of Dependabot we are deliberately keeping.
Testing
.github/dependabot.ymlparses as valid YAML; bothopen-pull-requests-limitvalues read0renovate.jsonchange needed — chore(ci): pin DMXr to Node 24 LTS and enforce it end to end #127 already gave itconstraintsFiltering, Node-major disabling, and<25bounds onnode-version/@types/node🤖 Co-authored by Claude Opus 5 (1M context). Follow-up to #125, #126, #127.
Summary by CodeRabbit