[belaboe]

Problem

Two tools update npm dependencies: the weekly dependency-update.yml job (npm-check-updates) and Dependabot. Both rewrite the same package.json files and package-lock.json, so their PRs conflict with each other. The ncu job opens one large PR per week that bundles every bump, so a single failing dependency blocks all the others.

Issue #, if available: none

Changes

• Delete .github/workflows/dependency-update.yml.
• Delete .ncurc.json (only read by ncu).
• Carry over its only rule: .ncurc.json rejects nuxt so the bump can't lift the <4.5.0 cap in test-apps/hosting-ssr-nuxt (nuxt 4.5 pulls an MPL-2.0 dependency). dependabot.yml now ignores nuxt >=4.5.0 instead, and the pin comment in that package.json points to it.

Dependabot takes over what the job did:

ncu job	Dependabot
Root + workspaces	npm entry at / (existing)
10 create-blocks-app templates	templates entry (#875)
Weekly	weekly (#873)
Raises package.json minimums	versioning-strategy: increase (#874)
Minor/patch only	minor/patch, plus separate major PRs
Build + local E2E before opening the PR	PR checks build and test every Dependabot PR (more than the job ran)
Manual run against any branch	not covered; run npx npm-check-updates -u --target minor locally if a branch needs it

Before merging

• Merge chore(repo): run npm Dependabot version updates weekly #873, chore(repo): raise package.json minimums in npm Dependabot updates #874 and chore(repo): add Dependabot version updates for create-blocks-app templates #875 first, so Dependabot covers everything the job did before the job goes away.
• scripts/generate-dependency-changeset.ts (from ci(deps): fix weekly bump PR checks (changeset + brace-expansion advisory) #666) stays; it was only called by this job and will be reused to add changesets to Dependabot PRs.
• After merging, close the open ncu PRs (chore: weekly dependency bump for wirej/dep-management (2026-09-29) #647, chore: weekly dependency bump for main (2026-09-30) #664, chore: weekly dependency bump for main (2026-10-03) #687, chore: weekly dependency bump for main (2026-10-10) #751).

Validation

• No other file references dependency-update.yml, .ncurc.json or npm-check-updates.
• dependabot.yml parses; the root npm entry ignores nuxt >=4.5.0.
• CI config only, no published package changed, so no changeset is required (same as chore(repo): set Dependabot's default 3-day cooldown explicitly #869).

Checklist

• PR description included
• Tests are changed or added (CI config only)
• Relevant documentation is changed or added (none references the job)

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 119f714

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[osama-rizk]

This retires the weekly npm-check-updates (ncu) job in favour of Dependabot. The nuxt rule carries over correctly, and with #873/#874/#875 merged Dependabot covers every manifest the job did. One blocking gap: the job also wrote the changeset that the required Require changeset check needs, and nothing replaces that yet. Dependabot PRs pass today only because pending changesets on main happen to cover every package, so they will start failing after the next release.

Dimensions

• Correctness: good. dependabot.yml parses, and ignore nuxt versions >=4.5.0 matches the .ncurc.json reject for the only nuxt consumer (test-apps/hosting-ssr-nuxt).
• Contract/compatibility: concern. The comparison table leaves out the job's changeset step (inline on .github/dependabot.yml:29), and the manual fallback is incomplete (inline on test-apps/hosting-ssr-nuxt/package.json:25).
• Tests: good for a config-only change. I verified with local repros instead (changeset guard before and after a simulated release, and an ncu dry run on the nuxt pin).
• Design/reuse: good. One tool instead of two, and per-dependency PRs stop one bad bump from blocking the rest.
• Systemic/ops: concern. Two required checks are affected over time: Require changeset (blocking item) and E2E Sandbox (Dependabot runs get no repository secrets). The second isn't a regression, because ncu PRs created with GITHUB_TOKEN triggered no CI at all.

What's good

• The job is retired cleanly: no other file, doc (AGENTS.md, CONTRIBUTING.md, CLAUDE.md), script or package.json script references dependency-update.yml, .ncurc.json or npm-check-updates.
• The nuxt pin comment now points to the rule that actually enforces it.
• Coverage maps cleanly onto the job's. The root / entry updates all workspace manifests that declare a dependency in a single PR (see #889), so ranges stay aligned across packages, as with ncu --workspaces. The 10 template roots are covered once #875 lands. The job had no other filters (no aws-cdk-lib alignment rule, no @aws-blocks/* rule) that could be lost.
• Build, Unit Tests, E2E Local runs unconditionally on every PR, so each Dependabot PR gets at least the build plus test:e2e:local that the job ran.

What needs work: 1 blocking · 1 minor. Details are in the inline comments.

Open questions

1. Will the Dependabot changeset automation land before this PR, or should this PR wait for it? Today the dependency is only implied by "will be reused".
2. Ordering: each of #873/#874/#875 merges cleanly with this PR in either order (I tried both). So "merge them first" is a coverage requirement, not a conflict requirement: before #875, templates get no updates; before #873, the cadence drops to monthly; before #874, minimums stop moving. Could you add the changeset automation to that list? Separately, #869 and #873 conflict with each other in dependabot.yml, whichever lands second.

Cross-cutting (description only, no line to anchor)

• The CI row says PR checks test Dependabot PRs "more than the job ran". That holds for the local suite, but the required E2E Sandbox and E2E Production jobs get no secrets on Dependabot-triggered runs and need a maintainer push to run (as on #889). Worth one sentence in the table.
• "After merging, close the open ncu PRs (#647, #664, #687, #751)": all four are already closed.
• Neither tool covers these manifests, before or after this PR, so this is a pre-existing gap and not a regression: native/kotlin, native/swift (and their TypeScript example apps), packages/create-block/templates/primitive, packages/foundations, test-apps/amplify-gen2/amplify, test-apps/native-bindings/aws-blocks, test-apps/vpc-smoke/aws-blocks. If the native example apps should track releases, they need their own Dependabot entry.

[osama-rizk]

Blocking: retiring the job also retires the only thing that wrote changesets for dependency bumps, and nothing in this series replaces it.

The deleted .github/workflows/dependency-update.yml (lines 54-65, the "Generate changeset for bumped packages" step) ran scripts/generate-dependency-changeset.ts, which #666 added because bump PRs were failing Require changeset. That check is required on main. Dependabot writes no changeset, and with versioning-strategy: increase (#874) every npm Dependabot PR rewrites packages/*/package.json, so each one needs a changeset for every published package it touches, plus @aws-blocks/blocks.

Today this is hidden: Dependabot PRs such as #889 (it touches packages/bb-async-job/package.json) pass only because unconsumed changesets on main (including .changeset/dependency-bump-2026-10-19.md) happen to list every package. I reproduced the post-release state locally: remove all pending changesets as the Version Packages PR does, apply a Dependabot-style range bump to packages/bb-async-job/package.json, and changeset-guard.ts verify-coverage exits 1 with @aws-blocks/bb-async-job missing. Running generate-dependency-changeset.ts on the same tree makes both verify-coverage and verify-umbrella pass. So after the next release, every Dependabot npm PR (and every #875 template PR, since packages/create-blocks-app/** maps to @aws-blocks/create-blocks-app) will be blocked until someone writes a changeset by hand.

Fix: before this merges, land the automation the description mentions and list it under "Before merging": a workflow that runs on Dependabot PRs (for example pull_request_target gated on github.actor == 'dependabot[bot]', running the base branch's copy of generate-dependency-changeset.ts against the PR diff) and pushes the changeset to the Dependabot branch. Push with an app or bot token rather than GITHUB_TOKEN, because GITHUB_TOKEN pushes don't trigger pull_request workflows. That same push would also give the required E2E Sandbox jobs repository secrets, which is what the manual "trigger CI with repository credentials" commit on #889 does today. One more thing the automation has to handle: the generator only matches packages/<x>/package.json. On a template-only bump (the kind #875 opens) it prints "No published packages changed" and writes nothing, yet verify-coverage still requires @aws-blocks/create-blocks-app. I reproduced this on templates/react/package.json. The ncu job never ran into it because its PRs always bumped workspace packages too, so the generator should also map packages/<x>/** the way changeset-guard.ts does. If you'd rather keep this PR small, add a "Changeset per bump" row to the comparison table that says "not covered yet" and block this PR on the follow-up.

[belaboe]

Covered by #977, which writes the changeset for Dependabot bumps at release time (including template-only bumps). #995 (#876 rebased) lists "#977 merges first" under Before merging and adds the changeset row to the table.

[osama-rizk]

Non-blocking (minor): this comment is right about Dependabot, but the manual fallback in the PR description can now rewrite this cap.

With .ncurc.json deleted, nothing stops ncu from touching nuxt any more. The description replaces the job's manual run with npx npm-check-updates -u --target minor. As written, that only updates the root package.json, so it doesn't reproduce what the job did. Once someone adds --workspaces to match the job, it lifts this pin: a dry run on this file gives nuxt >=4.0.0 <4.5.0 -> ^4.6.2. That lands the MPL-2.0 lightningcss dependency this comment exists to keep out.

Fix: give the full equivalent of the deleted job in the description (or in CONTRIBUTING.md, so it outlives the PR), for example npx npm-check-updates -u --target minor --root --workspaces --reject nuxt, plus the per-template loop and node --experimental-strip-types scripts/generate-dependency-changeset.ts origin/<branch> manual. Also add a few words here, e.g. "Dependabot ignores nuxt >=4.5.0, and manual ncu runs must pass --reject nuxt", so the cap doesn't depend on which tool is used.

[belaboe]

Fixed in #995: since #929 there is no nuxt cap left, so the rebase drops the nuxt ignore and this package.json hunk, and the description gives the job's full manual equivalent (root + workspaces, the template loop including amplify/aws-blocks, build, local e2e, changeset script).

[belaboe]

@osama-rizk follow-ups on the review summary, now in #995 (#876 rebased onto main):

• Q1/Q2: "ci(release): write the changeset for Dependabot bumps at release time #977 merges first" is under Before merging, with the full order chore(repo): run npm Dependabot version updates weekly #873, chore(repo): raise package.json minimums in npm Dependabot updates #874, ci(deps): limit the Dependabot dev-dependencies group to minor and patch updates #935, chore(repo): add Dependabot version updates for create-blocks-app templates #875, ci(release): write the changeset for Dependabot bumps at release time #977, chore(repo): retire the weekly ncu dependency update job #876. The chore(repo): set Dependabot's default 3-day cooldown explicitly #869/chore(repo): run npm Dependabot version updates weekly #873 conflict is resolved in chore(repo): #873 rebased + review fixes: weekly npm Dependabot updates #991.
• The CI row now says that E2E Sandbox and E2E Production get no secrets on Dependabot-triggered runs.
• The "close the open ncu PRs" line is gone, since all four were already closed.

[belaboe]

Replaced by #995, which is this change rebased onto main with the review fixes. #995 lands last in the series, after #977.