Enable Dependabot npm version updates for the twelve standalone apps/* installs - #81
Merged
Merged
Conversation
… updates The npm configuration only watched the root workspace lockfile, so the twelve standalone installs under apps/ -- each owning its package.json and lockfile -- received no version updates at all. The bumps that did land there came from Dependabot's security updates, which scan every manifest regardless of this file. Add one npm entry per directory that owns a lockfile, matching the conventions of the existing entries: weekly schedule, a 7-day release cooldown, and minor + patch bundled into a single grouped pull request so majors stay separate. Each group is named after its directory, so a pull request title says which app it belongs to. One entry per directory rather than a single entry listing them under `directories:`: combined with `groups:`, that form can bundle unrelated apps into one pull request, and such a pull request goes stale the moment any one of those directories moves -- #76 is an open example, superseded by #79. Carry over the held majors from the per-app Dependabot configs of the source repositories (apps/<name>/.github/dependabot.yml, inert since GitHub reads only the root file): React 18 and the Tailwind 3 / daisyUI 2 pair in hackathon, TypeScript 5 and symbol-sdk 2 in its functions, firebase-admin 13 in flea-market's functions (firebase-functions 7 peers on ^11 || ^12 || ^13), and ESLint 10 in xymposium-lp-2024, whose bundled eslint-plugin-react still calls the removed context.getFilename(). Each hold was re-checked against the current manifest; hackathon's ESLint hold is deliberately not carried over, as that app is already on ESLint 10. apps/flea-market/worker and packages/* stay absent: they have no lockfile of their own and are already updated through the root workspace entry. The per-app limit is 5 rather than the root entry's 10 to cap how much lands for review on any one weekly run.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
.github/dependabot.ymlwatched npm dependencies in the root workspace lockfileonly. The apps under
apps/install standalone — each owns itspackage.jsonand lockfile, deliberately, so React 18 (
hackathon) and React 19(
flea-market) stay isolated — and none of them was covered. They receivedversion updates from nobody; the dependency bumps that did land there came from
Dependabot's security updates, which scan every manifest in the repository
regardless of this file.
This adds one npm entry per directory that owns a lockfile.
Directories now covered
apps/flea-marketpackage-lock.jsonapps/flea-market/functionspackage-lock.jsonapps/hackathonpackage-lock.jsonapps/hackathon/functionspackage-lock.jsonapps/hackathon-lppackage-lock.jsonapps/hackathon-lp-2023package-lock.jsonapps/hackathon-lp-2024package-lock.jsonapps/hackathon-lp-2025package-lock.jsonapps/hackathon-lp-2026pnpm-lock.yamlapps/xymposium-lppackage-lock.jsonapps/xymposium-lp-2024package-lock.jsonapps/xymposium-lp-2025package-lock.jsonThe list is exactly the set of lockfiles tracked in git, minus the root one.
apps/flea-market/workerandpackages/*are absent on purpose: they have nolockfile of their own and resolve through the root workspace entry, which is
unchanged.
apps/hackathon-lp-2026installs with pnpm;package-ecosystem: npmis theecosystem that reads
pnpm-lock.yaml.Held majors carried over
Each imported app brought its own
.github/dependabot.yml, which stays in thetree but is inert — GitHub reads only the root file. Those copies carry reasoned
major holds, so the new entries carry them too. Every one was re-checked against
the manifest as it stands on
main:apps/hackathonreact,react-dom,@types/react,@types/react-domflea-marketreact ^18.2.0apps/hackathontypescripttypescript ^5.9.3apps/hackathondaisyui,tailwindcssdaisyui ^2.52.0,tailwindcss ^3.4.19apps/hackathon/functionstypescript,eslinttypescript ^5.9.3,eslint ^8.57.1apps/hackathon/functionssymbol-sdksymbol-sdk ^2.0.7apps/flea-market/functionsfirebase-adminfirebase-functions@7.2.5peers on^11.10.0 || ^12.0.0 || ^13.0.0, so 14 cannot resolvefirebase-admin ^13.5.0apps/xymposium-lp-2024eslint(>=10)eslint-plugin-reactbundled witheslint-config-nextstill callscontext.getFilename(), removed in ESLint 10eslint ^9One hold was not carried over:
apps/hackathon's ESLint major. That app isalready on
eslint ^10.9.0, so the hold is spent.@types/nodeis held everywhere it is declared, for the same reason as the rootentry — it tracks the Node runtime major.
Conventions
Each new entry mirrors the existing ones:
schedule: weeklycooldown: default-days: 7— wait a week after a release before proposing itminor+patchfor version updates, so majors stillopen individually. Groups are named after their directory
(
hackathon-lp-2024-minor-patch, …) so a pull request title says which app itbelongs to.
@types/nodehold its major, for the samereason the root entry does: it tracks the Node runtime major.
Two deliberate differences from the root entry:
open-pull-requests-limit: 5, not 10. Limits are per entry, not a sharedbudget; 5 caps how much of these twelve entries' output lands for review on
any one weekly run.
directories:. The plural formis more compact, but combined with
groups:it can bundle unrelated apps intoa single pull request, and a grouped pull request spanning several directories
goes stale the moment any one of those directories moves — build(deps): bump the npm_and_yarn group across 4 directories with 16 updates #76 is an open
example, superseded by build(deps): bump the npm_and_yarn group across 3 directories with 16 updates #79 and no longer mergeable. GitHub's options reference
does not document how
directoriesandgroupsinteract, so this takes theform whose behaviour is unambiguous.
What this does not do
It enables version updates. It does not resolve any existing Dependabot
security alert — security updates already run independently of this file — and
it changes no dependency: the only file touched is
.github/dependabot.yml.Expect a burst on the next weekly run: one grouped minor/patch PR per covered
directory, plus individual majors. The four static landing pages depend only on
firebase-tools, so their entries will be quiet after the first pass;apps/xymposium-lp-2025has no dependencies at all yet and its entry is aplaceholder that starts working when it gains some.
Worth knowing before merging the PRs this produces:
apps/hackathon,apps/hackathon/functionsand the static landing pages have no checks workflow,so their pull requests will arrive with nothing verifying them, and
ci-flea-marketruns onapps/flea-market/**but only exercises the frontend —a green check there says nothing about
apps/flea-market/functions. Thoseupdates need a local build before merge until the coverage gap is closed.
Verification
dependabot-2.0schema.directoryvalues across the npm entries matches the set oflockfile directories tracked in git exactly — no directory missed, none listed
that has no lockfile.
schedule,cooldownand groupapplies-to/update-typesvalues as the root entry.ignorerule was checked to name a dependency the directory's manifestactually declares, and one still below the held major.
github-actionsand rootnpmentries are unchanged apart fromthe comment above the latter, which claimed the apps were deliberately not
enumerated and is no longer true.