fix(deps): roll back dependabot major bumps and pin frozen majors#45
Merged
Conversation
Dependabot landed next 16, tailwindcss 4, typescript 6 and eslint 10 on main. These are breaking majors that were never migrated, so CI (lint and build) was red. The frozen-deps policy was meant to prevent exactly this but only blocked diffs that changed a major, so a bump that reached the baseline branch was no longer flagged. - Roll next, tailwindcss, typescript and eslint back to their pinned majors (15, 3, 5, 9) and realign eslint-config-next to 15. - Rewrite check-frozen-deps to enforce a canonical major baseline instead of a differential, so a stray major bump is rejected even after it lands on the baseline branch.
Stop Dependabot from opening major-bump PRs for next, eslint-config-next, tailwindcss, typescript and eslint, which check-frozen-deps now rejects. Avoids recurring red PRs for upgrades that are intentionally pinned.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
next,tailwindcss,typescriptandeslintback to their pinned majors (15, 3, 5, 9) and realigneslint-config-nextto 15.check-frozen-depsto enforce a canonical major baseline instead of a differential.Why
Dependabot landed
next16,tailwindcss4,typescript6 andeslint10 on main. These are breaking majors that were never migrated, so lint and build were red:eslint-plugin-reactbundled by eslint-config-next.The frozen-deps policy was meant to prevent exactly this, but it only blocked diffs that changed a major. Once a bump reached the baseline branch it was no longer flagged. The new canonical-baseline check rejects any frozen dependency whose major differs from the pin, so a stray major bump is caught even after it lands.
Verification
npm run lint -- --max-warnings 0,npx tsc --noEmitandnpm run buildall pass locally on the rolled-back stack.Merge order
Merge this first. It turns main green.
chore/db-migrate-guardrailbranched off the broken main and must be rebased on top of this before its CI can pass.