Tighten Dependabot update policy - #11
Conversation
454c274 to
12486ee
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 12486ee537
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - dependency-name: "*" | ||
| update-types: | ||
| - version-update:semver-major |
There was a problem hiding this comment.
When an npm advisory can only be remediated by crossing a major-version boundary, this wildcard ignore condition also excludes that version from Dependabot's security-update job, so no remediation PR will be opened despite the commit's stated goal of leaving security updates unaffected. Dependabot's ignore rules are not scoped only to scheduled version updates; remove this global rule or enforce the routine-major policy through a mechanism that distinguishes version updates from security updates.
Useful? React with 👍 / 👎.
1 participant
What changed
Why
The initial Dependabot run mixed incompatible React, Vite, TypeScript, and Babel major upgrades across this pnpm monorepo. That created noisy PRs and broke the intentional React 18/19 compatibility matrix.
Validation
.github/dependabot.ymlas YAMLgit diff --checkPrivacy and compatibility
No runtime, production bundle, observed data, or package API changes.