Repository navigation
chore(deps): merge npm Dependabot entries and add cooldown - #209
Merged
Merged
Conversation
- one npm entry for console, site and desktop, so a week's minor and patch updates arrive as one PR instead of three - group github-actions updates into one PR - 7-day cooldown on both ecosystems (14 days for npm majors) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Signed-off-by: John Siracusa <siracusa5@users.noreply.github.com>
This was referenced Oct 28, 2026
Adds a security-updates group to each ecosystem so a backlog of alerts arrives as a single PR. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Signed-off-by: John Siracusa <siracusa5@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
/apps/console,/apps/site,/apps/desktop) become one entry withdirectories:and onenpm-minor-and-patchgroup. A group spans every listed directory, so a week of minor and patch updates is one PR.github-actionsgets a group, socodeql-actionand the others stop opening one PR each.Why
Dependabot opened 26 PRs here between Sep 1 and Oct 28. Majors still arrive one PR each (electron 45 is open now), which is the PR that needs a human.
A new release now has to sit for a week before Dependabot proposes it. Hijacked releases are usually found and pulled within days, so the wait keeps them out. Security updates ignore the cooldown.
Not changed
mainhas no required status checks yet, so nothing would hold an auto-merge until CI passes.If one app's update fails CI, the shared PR is red for all three. Split the group again if that gets in the way.
Test plan
🤖 Generated with Claude Code
Security updates
Each ecosystem also has a
*-securitygroup withapplies-to: security-updates. When Dependabot security updates are on, a backlog of alerts arrives as one PR per ecosystem instead of one PR per package. The group only takes effect once this file is on the default branch.