Specify exactly where package.json files are located by fanninpm · Pull Request #9345 · RustPython/RustPython

fanninpm · 2026-10-24T16:33:56Z

Closes #xxxx

One of checkbox below must be checked.

I did not use AI to write the code of this patch.
This PR follows our AI policy

Summary

Dependabot keeps failing to find NPM updates because it expects a package.json file at the root of the repository. We don't structure RustPython like that, so I told Dependabot where to look for package.json files.

Summary by CodeRabbit

Chores
- Automated dependency update checks now cover packages in the wasm directories instead of the repository root.
- The checks continue to run weekly, and the existing cooldown settings remain unchanged. This affects which parts of the project are included in dependency monitoring; no change to the update-check schedule is included.

chatgpt-codex-connector · 2026-10-24T16:34:12Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T16:36:21.919477Z	`b5115b4`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

coderabbitai · 2026-10-24T16:34:49Z

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: RustPython/RustPython
Branch: main
File: .coderabbit.yml
Commit: 5bccf31
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: 78af64c7-0b54-4e83-8828-c841113ca069

Commits

Reviewing files that changed from the base of the PR and between 5bccf31 and b5115b4.

Files selected for processing: 1

.github/dependabot.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

The npm Dependabot configuration now scans directories matching wasm/*. Its weekly schedule and cooldown settings remain unchanged.

Changes: Dependabot npm configuration

Layer / File(s)	Summary
Set npm update directories `.github/dependabot.yml`	The npm update configuration now uses `directories: ["wasm/*"]` instead of `directory: /`.

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: shaharnaveh

Merge Risk: Minimal · up to b5115

Dependabot is configured to scan every package directory in the repository.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "Specify exactly where package.json files are located" matches the changeset. The raw summary shows the npm Dependabot configuration in .github/dependabot.yml now targets the wasm/* director…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "Specify exactly where package.json files are located" matches the changeset. The raw summary shows the npm Dependabot configuration in .github/dependabot.yml now targets the wasm/* directories instead of the repository root, which directly addresses the stated objective of telling Dependabot where package.json files live. The title is specific and describes the main change from the developer's perspective. No web search was needed for this check.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

fanninpm · 2026-10-24T16:41:35Z

@coderabbitai Will this change fix the problem of Dependabot not finding the package.json files?

coderabbitai · 2026-10-24T16:42:04Z

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
printf '%s\n' '--- Dependabot configuration ---'
cat -n .github/dependabot.yml
printf '%s\n' '--- Package manifests ---'
fd --hidden --type f '^package\.json$' --exclude .git

Length of output: 5495

🤖 web_search executed:

GitHub Dependabot configuration options directories glob wildcard * directory npm package.json official documentation

Length of output: 11553

@fanninpm Yes—this change should fix the manifest-discovery problem.

The npm entry in .github/dependabot.yml now uses directories: ["wasm/*"]. That pattern matches all three package.json locations:

wasm/demo/package.json
wasm/example/package.json
wasm/notebook/package.json

GitHub documents wildcard support for directories, so Dependabot can scan these locations instead of looking only at the repository root. citeturn0search0

I verified the paths and configuration, but I have not observed a Dependabot run. After merging, check the next npm update-job log to confirm successful discovery. The weekly schedule and cooldown can delay update PRs even when discovery succeeds.

_{You are interacting with an AI system.}

youknowone · 2026-10-25T06:11:48Z

Thanks!!

Integrate main at 9bd84b2 while preserving the published mega history. Keep the authentic profiler locator and capabilities from RustPython#9340, set-cycle GC from RustPython#9343, backward-compatible bytecode tooling from RustPython#9344, package paths from RustPython#9345, canonical Levenshtein coverage from RustPython#9346, and the safe full-width None-return scanner from RustPython#9347. Regenerate support helpers through the official updater from unchanged CPython d220409a13b7, preserving four exact existing-main neighborhoods. Retain the newer main specialization/C-stack helpers, Cargo environment adaptation, prior isolation checks and remaining Python 3.15 updates. The obsolete manual capability guard is superseded by the genuine API. Preserve unlanded explicit sharing modes and opcode override support. Ruff and XML vendor sources remain unchanged. Validation: normal hooks, locked host_env/VM/stdlib library check and strict Clippy, and the default CLI build. No target-runtime or full-suite pass is claimed for this composition. Assisted-by: OpenAI Codex:model version unavailable

Specify exactly where package.json files are located

b5115b4

fanninpm requested review from ShaharNaveh and youknowone October 24, 2026 16:39

youknowone approved these changes Oct 25, 2026

View reviewed changes

youknowone merged commit a8ad41e into RustPython:main Oct 25, 2026
21 checks passed

fanninpm deleted the dependabot-wasm branch October 25, 2026 17:28

Navigation Menu

Repository navigation

Specify exactly where package.json files are located - #9345

Specify exactly where package.json files are located#9345
youknowone merged 1 commit into
RustPython:mainfrom
fanninpm:dependabot-wasm

fanninpm commented Oct 24, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 24, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 24, 2026 •

edited

Loading

Uh oh!

fanninpm commented Oct 24, 2026

Uh oh!

coderabbitai Bot commented Oct 24, 2026

Uh oh!

Uh oh!

youknowone commented Oct 25, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

fanninpm commented Oct 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Summary by CodeRabbit

Uh oh!

chatgpt-codex-connector Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

coderabbitai Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fanninpm commented Oct 24, 2026

Uh oh!

coderabbitai Bot commented Oct 24, 2026

Uh oh!

Uh oh!

youknowone commented Oct 25, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fanninpm commented Oct 24, 2026 •

edited by coderabbitai Bot

Loading

chatgpt-codex-connector Bot commented Oct 24, 2026 •

edited

Loading

coderabbitai Bot commented Oct 24, 2026 •

edited

Loading