From adf9ecf19e6b455cdd3019f6b238a8e832eb88e5 Mon Sep 17 00:00:00 2001 From: Lorem Dev Date: Tue, 8 Sep 2026 23:13:18 +0200 Subject: [PATCH 1/2] ci: keep action majors out of the grouped update The github-actions group matched every pattern with no update-type filter, unlike the cargo and npm groups below it. Its first run put six updates in one pull request, three of them majors: tauri-action v0.6.2 to v1.0.0, setup-uv v7.6.0 to v10.0.1, and the checkout / setup-node / artifact v5-to-v7 line. That is the wrong shape for this repository specifically. tauri-action appears only in release.yml and setup-uv only in docs.yml, and neither workflow runs on a pull request -- release.yml is tag-only and docs.yml triggers on a push to main. A green pull request check therefore said nothing at all about the two riskiest lines in the diff, and the first real exercise of a v0-to-v1 bundler major would have been a release tag, across six matrix legs holding the signing secrets. Restricting the group to minor and patch makes every major arrive on its own, where the diff is small enough that its changelog is obviously the thing under review. --- .github/dependabot.yml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 618b36d8..17e86e77 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -32,9 +32,18 @@ updates: commit-message: prefix: 'chore(deps)' groups: + # Minor and patch only, the same as the two ecosystems below. Without + # this the group batched everything: its first run put six updates in one + # pull request, three of them majors -- tauri-action v0.6.2 to v1.0.0, + # setup-uv v7.6.0 to v10.0.1, and the checkout/setup-node/artifact v5-to- + # v7 line. tauri-action appears only in release.yml and setup-uv only in + # docs.yml, and neither workflow runs on a pull request, so a green check + # said nothing about either. A major there has to arrive alone, where its + # own changelog is the thing under review. github-actions: - patterns: - - '*' + update-types: + - minor + - patch ignore: # Pinned to an exact Rust version that must move together with # rust-toolchain.toml (see the comment there). A pull request bumping From 16cab69940c445f8fc02d45e147854dafafabc47 Mon Sep 17 00:00:00 2001 From: Lorem Dev Date: Tue, 8 Sep 2026 23:16:14 +0200 Subject: [PATCH 2/2] ci: hold @types/node at the Node major the project runs Dependabot offered @types/node 24.13.3 -> 26.4.1 while `engines` asks for Node >= 24 and every workflow pins `node-version: '24'`. That bump is not a dependency update so much as a claim about the runtime: tsc would start accepting APIs Node 24 does not have, the type check would stay green, and the failure would move to run time -- the one place these types exist to keep it out of. Ignoring only the major keeps the 24.x patches flowing. When the runtime moves, the types move with it in the same change. --- .github/dependabot.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 17e86e77..1d162c9d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -94,3 +94,13 @@ updates: update-types: - minor - patch + ignore: + # @types/node's major tracks the Node major, and this project pins Node + # 24 in `engines` and in every workflow. Taking the types for 26 while + # running 24 makes tsc accept APIs the runtime does not have: the type + # check goes green and the failure moves to run time, which is the one + # place these types exist to keep it out of. Bump this together with the + # runtime, not ahead of it. + - dependency-name: '@types/node' + update-types: + - version-update:semver-major