chore(deps): stop Dependabot proposing React bumps it cannot land - #611
Open
JakubAnderwald wants to merge 1 commit into
Open
JakubAnderwald wants to merge 1 commit into
JakubAnderwald wants to merge 1 commit into
Conversation
React's version lives in the root package.json's `pnpm.overrides` — the mechanism that forces the single shared React instance ADR-0027 / #558 require. Dependabot cannot edit that key. It can only rewrite pnpm-lock.yaml's `overrides:` block, so every React PR it opens takes one of two useless shapes: - inert: bumps apps/*/package.json while the override silently overrules it, so nothing actually moves (#593), or - unmergeable: a lockfile-only override edit that aborts every install with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH (#609, which also failed the Vercel preview deployment and all six CI jobs). Ignore react, react-dom and react-test-renderer by exact name — deliberately not a `react*` wildcard, which would swallow the react-native family that has its own tuned rules directly above. This does not contradict ADR-0027 §5. That decision forbids freezing React so it silently rots; this suppresses a mechanism structurally incapable of moving it correctly. React still moves as one deliberate coordinated step — edit pnpm.overrides, regenerate the lockfile, verify (#441, #610) — which remains the prerequisite for adopting react-native-macos@0.83. Recorded as a dated update note on ADR-0027, matching how the RN-family ignore was recorded there. Verified: dependabot.yml parses (14 ignore entries, no wildcard leakage into the react-native family), format:check, scripts tests 783/783. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #610, which fixed the drift but not the mechanism that recreates it.
The problem
React's version lives in the root
package.json'spnpm.overrides— the mechanism that forces the single shared React instance ADR-0027 / #558 require. Dependabot cannot edit that key. It can only rewritepnpm-lock.yaml'soverrides:block, so every React PR it opens takes one of two useless shapes:apps/*/package.jsonwhile the override silently overrules it — nothing actually movesERR_PNPM_LOCKFILE_CONFIG_MISMATCH#609 is the one that generated the failed-preview-deployment email: it took down the Vercel preview and all six CI jobs, and could never have been fixed by rebasing or retrying.
Without this rule the exact same PR reappears on the next React patch release.
The change
Ignore
react,react-dom,react-test-rendererby exact name — deliberately not areact*wildcard, which would swallow thereact-nativefamily that has its own carefully tuned minor/major rules directly above in the same file.Why this doesn't contradict ADR-0027 §5
§5 says "Do not freeze the rnm/React pair from Dependabot permanently; instead upgrade the pair deliberately, together." That forbids freezing React so it silently rots. This suppresses a mechanism structurally incapable of moving it correctly — the deliberate cadence §5 asks for is exactly what remains:
which is how React last moved in #441 and #610, and remains the prerequisite for adopting
react-native-macos@0.83.Recorded as a dated update note on ADR-0027 rather than a new ADR, matching how the RN-family ignore was recorded there in July. ADR body left otherwise untouched (append-only).
Verification
dependabot.ymlparsesreact-native*pnpm format:checkNo code changes — config and docs only.
🤖 Generated with Claude Code