Skip to content

chore(repo): review fixes for #874: versioning-strategy comment #992

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
belaboe merged 1 commit into from
Oct 26, 2026
Merged

chore(repo): review fixes for #874: versioning-strategy comment #992

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,12 @@
# and dev-dependencies (build/test only, low blast radius). Production deps
# and security fixes land as their own PRs so each shipped bump stays
# reviewable and mergeable on its own.
# - versioning-strategy: increase raises the minimum version in package.json
# to the new release (^3.2.0 -> ^3.3.1), not only the lockfile.
# - versioning-strategy: increase raises the minimum in package.json to the
# new release (^3.2.0 -> ^3.3.1), as the ncu job does. It pins what "auto"
# already resolves to here (the root package.json is not detected as a
# library). Dependabot doesn't read peerDependencies (it only rewrites a
# peer range identical to the one it bumps, none here), so the
# aws-cdk-lib/constructs peer floors stay manual.
# - typescript and @types/node are toolchain foundations: a major bump is a
# deliberate migration, not routine hygiene (TS 7 / @types/node 26 broke the
# project-reference build in one grouped PR). So they are excluded from the
Expand Down
Loading