Repository navigation
Group Dependabot updates - #3263
Merged
Merged
Conversation
We get a steady stream of PRs to bump actions, most of them for `ruby/setup-ruby`, which releases most weeks. Bumping our actions is low risk, so we can review them together in one PR each week. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Each week brings a few gem bumps, but they're spread across lots of gems, so the groups for specific gems still leave us with mostly single-gem PRs. Grouping minor and patch bumps by Gemfile group gives us at most two PRs a week, and keeps test tooling bumps separate from the gems we run in production. The AWS SDK gems now fall into the production group. The Sentry and Vite Ruby groups only need to handle major bumps, which the new groups leave out, so those gems still get bumped together. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Rails minor releases can change framework defaults and deprecate behaviour, so we want to review them on their own rather than as part of the production gems group. Rails patch releases are still grouped. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Most of our npm PRs are for build and test tooling such as Vite, Vitest, Sass and PostCSS, which release often. Our CI checks that a bump to these still builds and passes tests, so they can share a weekly PR. govuk-frontend and our other production packages change what users see, so they still get their own PRs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Version update groups don't apply to Dependabot security updates, so these still arrive one dependency at a time, mostly for packages we don't depend on directly, such as undici, js-yaml, rack and nokogiri. Grouping them per ecosystem means fewer PRs to review. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
theseanything
changed the title
|
🎉 A review copy of this PR has been deployed! You can reach it at: https://pr-3263.admin.review.forms.service.gov.uk/ It may take 5 minutes or so for the application to be fully deployed and working. If it still isn't ready For the sign in details and more information, see the review apps wiki page. |
theseanything
marked this pull request as ready for review
October 29, 2026 14:53
This was referenced Oct 29, 2026
DavidBiddle
approved these changes
Oct 30, 2026
DavidBiddle
left a comment
DavidBiddle
left a comment
Contributor
There was a problem hiding this comment.
Seems like a sensible change to me.
It doesn't affect this PR but a potential next step - Github now supports multi-ecosystem groups, so in a future PR we might be able to add groups for:
- bundler's
vite_ruby/vite_railsand npm'svite-plugin-ruby - bundler's
govuk-components/govuk_design_system_formbuilderand npm'sgovuk-frontend
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What problem does this pull request solve?
Trello card:
Dependabot opens about 7 PRs a week on this repo, mostly for single dependencies. This groups minor and patch bumps so we get fewer PRs to review:
Majors, Rails minor upgrades and npm production packages such as govuk-frontend still get their own PRs. Schedules stay weekly.
Applying this to last year's bumps gives about 4 PRs a week instead of 7.
Things to consider when reviewing
sentryandvite_rubynow only group major bumps. Their minor and patch bumps go in the gem groups.