chore(deps): consolidate dependabot into one grouped PR, minor/patch only - #16
Merged
Merged
Conversation
…only Routine version updates are limited to minor and patch; semver-major bumps are ignored. The version-update: prefix scopes that ignore to version updates only, so a security advisory that can only be fixed by a major bump still opens a PR. Updates are grouped so they arrive as a single PR rather than one per dependency. Security advisories are grouped separately, per ecosystem. Mirrors the configuration proven on alaska-rcv, where it took 15 open Dependabot PRs down to 1. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FpuRSSAYEkdSSgnaFaoBKK
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of an org-wide Dependabot consolidation. This repo currently has 6 open Dependabot PRs.
What changes
1. Routine updates are minor/patch only —
ignoredropsversion-update:semver-major. That prefix scopes the ignore to version updates, so a security advisory whose only fix is a major bump still opens a PR. Removing theupdate-types:key would make it a blanket ignore that silences security updates too; there's a comment in the file saying so.2. One PR instead of one per dependency. One ecosystem (npm), so a plain
patterns: ["*"]group is used;open-pull-requests-limit: 3stays on the update entry, which is valid there.3. Security advisories grouped separately via
*-securitygroups withapplies-to: security-updates— one PR per ecosystem rather than one per advisory.Already proven in this org
Running on alaska-rcv (15 PRs → 1), star-view (7 → 1), star-core (5 → 1), starpy and discord-bot.
On star-view, Dependabot took the majors down to the highest in-range version rather than skipping them:
react16.12.0→19.2.8 became 16.12.0→16.14.0,typescript3.8.3→7.0.2 became 3.8.3→3.9.10.Two rules learned the hard way, both encoded in the config:
open-pull-requests-limitmust not appear on an update entry belonging to a multi-ecosystem group — Dependabot rejects the whole file, and the published JSON schema does not catch it.applies-tokey, so it covers version updates only. Hence the separate*-securitygroups.What happens to the existing PRs
Mostly nothing — Dependabot cleans up after itself. Once this merges, it supersedes its own stale PRs and folds them into the grouped PR automatically. On star-view it closed 7 and replaced them with 1, unprompted.
The exception is PRs whose package has no in-range update left (an orphaned
actions/checkout 4→7, say). Those linger and need closing by hand.This repo has 22 open security alerts. Nothing here will be closed without first cross-referencing every PR against those alerts — see below.
🤖 Generated with Claude Code
https://claude.ai/code/session_01FpuRSSAYEkdSSgnaFaoBKK