Repository navigation
chore(dependabot): batch only minor and patch; a major opens its own PR - #141
Conversation
#124 grouped every frontend update, and with nothing requiring the checks it merged five framework majors -- React 18->19, vite 6->8, TypeScript 5->7, react-router-dom 6->7, plotly 2->4 -- in one PR, with tsc already red until #140 repaired it. A major is a migration, not an update: it must carry its own review and its own CI run. Every Dependabot group now names update-types as minor and patch only -- an update matching no group opens its own PR -- for the frontend and for the github-actions pins alike (checkout v4.4.0 -> v7.0.1 came through #123 the same way). Minor and patch still batch as before, so the weekly noise stays low. A new testset in test_install_pins.jl pins the shape -- both ecosystems declared, the frontend on "bun", and no group whose update-types admit "major" -- so a future group cannot silently go back to batching majors. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 33 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
|
…etamanifold-webui
…etamanifold-webui
|
What this changes
#124 grouped every frontend update, and with nothing requiring the checks it merged five framework majors -- React 18->19, vite 6->8, TypeScript 5->7, react-router-dom 6->7, plotly 2->4 -- in one PR, with
tscalready red until #140 repaired it. A major is a migration, not an update: it must carry its own review and its own CI run.Both update groups (
frontend,github-actions-- checkout v4.4.0 -> v7.0.1 came through #123 the same way) now nameupdate-types: ["minor", "patch"]only. A Dependabot update matching no group opens its own PR, so majors arrive one at a time; minor and patch still batch weekly as before, so the noise stays low.A new testset in
test/unit/test_install_pins.jlpins the shape -- both ecosystems declared, the frontend onbun, and no group whoseupdate-typesadmitmajor-- so a future group cannot silently go back to batching majors. This is the same defence-in-depth the file already applies to workflow pins: the config asserts the policy, and the policy is enforced at the door.How to run its tests
From the repository root:
All testsets pass locally (223 prior assertions plus the new 9).
What this leaves out
No
open-pull-requests-limitor other throttles: with majors unbatched the default limit of 5 per ecosystem keeps the queue bounded, and the first runs under this config (#123/#124) showed the volume is small. No change to security updates, which follow their own path.Versions tested
Julia 1.13.1 locally (CI pins 1.12.5). No other tool touched.
Note: the commit is unsigned (the signing key's passphrase is unavailable to the session); amend to sign if required.
Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe vibe@mistral.ai