Conversation
✅ Deploy Preview for tolgee-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
dkrizan
force-pushed
the
dkrizan/stop-dependabot-major-noise
branch
from
September 3, 2026 13:49
ea1c5f7 to
46e5168
Compare
dkrizan
changed the title
dkrizan
force-pushed
the
dkrizan/stop-dependabot-major-noise
branch
from
September 3, 2026 13:50
46e5168 to
0529d1f
Compare
Every major bump Dependabot opened here needed a migration it cannot do: Tailwind 4 moves the PostCSS plugin, ESLint 10 needs flat config, React 19 is not supported by Docusaurus 3, and bumping @docusaurus/core alone leaves the other @Docusaurus packages behind. They failed CI, got closed, and came back the next month. Ignore conditions also suppress security update PRs, which would be a reason to list packages instead of using a wildcard, but Dependabot security updates and alerts are both disabled on this repository, so nothing is lost. Also groups the openapi-docs plugin and theme so they can only be bumped together. Bumping the plugin alone (#1103, #1122) breaks every API reference page in the browser while the build and deploy preview stay green.
dkrizan
changed the title
dkrizan
force-pushed
the
dkrizan/stop-dependabot-major-noise
branch
from
September 3, 2026 14:09
0529d1f to
f5535da
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Two things in
.github/dependabot.yml:Patch and minor updates keep coming as before.
Why
Every major bump Dependabot opened in this repo needed a migration it cannot do on its own:
@docusaurus/corealone leaves the other@docusaurus/*packages behind, so the build breaks.They all failed CI, got closed, and came back the next month. There are 4 closed react-dom branches and 3 for eslint. Doing a major by hand, when there is a reason to, is the only way these land.
The grouping rule fixes a worse problem. The openapi-docs plugin and theme must share a version. Bumping only the plugin (#1103, #1122) breaks every API reference page in the browser, and neither the build nor the deploy preview catches it, because the failure is client side.
On security updates
An
ignorerule also applies to Dependabot security update PRs, so a wildcard would normally be too blunt. It is fine here: Dependabot security updates and Dependabot alerts are both switched off for this repository, so there is nothing for the rule to suppress. If either is turned on later, this rule should become a list of package names instead.