From 0965b041fae6dd0fbfdf0079fd6fa92ddc94e50f Mon Sep 17 00:00:00 2001 From: Diego Rodrigues de Sa e Souza Date: Tue, 4 Aug 2026 18:07:16 -0300 Subject: [PATCH] chore(ci): stop dependabot from grouping ioredis majors with routine bumps (#9425) * chore(ci): stop dependabot from grouping ioredis majors with routine bumps ioredis is loaded through a dynamic import in the distributed quota store, so a breaking major passes build, typecheck and both test suites and only surfaces at runtime for operators running Redis-backed quota. #9310 grouped ioredis 5.10.1 to 6.0.0 with 9 unrelated production bumps; majors get their own PR from now on. * docs(changelog): add fragment for #9425 --------- Co-authored-by: diegosouzapw --- .github/dependabot.yml | 11 +++++++++++ .../maintenance/9425-dependabot-ioredis-major.md | 1 + 2 files changed, 12 insertions(+) create mode 100644 changelog.d/maintenance/9425-dependabot-ioredis-major.md diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 0913d78cd0..8db8504007 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -39,6 +39,17 @@ updates: # the duplication gate — migrate the gate intentionally, not via dependabot. - dependency-name: "jscpd" update-types: ["version-update:semver-major"] + # ioredis is a SOFT/optional dependency loaded through a dynamic import + # (src/lib/quota/redisQuotaStore.ts — "Redis driver requires ioredis package"), + # so a breaking major never fails at build or typecheck time: the only consumers + # are the distributed quota store (redisQuotaStore.ts, storeFactory.ts) and the + # `import type Redis` in src/shared/utils/rateLimiter.ts. Nothing in the unit or + # vitest suites exercises a live Redis connection, so a v5→v6 API break would ship + # green and only surface at runtime for operators running distributed quota — the + # exact users least able to absorb it. #9310 grouped that major with 9 harmless + # bumps; majors here need their own PR and a deliberate migration review. + - dependency-name: "ioredis" + update-types: ["version-update:semver-major"] # @huggingface/transformers is HARD-PINNED at 3.5.2 (exact, no caret) — FROZEN. # It is load-bearing for the LLMLingua ONNX compression engine (open-sse/services/ # compression/engines/llmlingua/ — worker.ts pins @huggingface/transformers@3.5.2) diff --git a/changelog.d/maintenance/9425-dependabot-ioredis-major.md b/changelog.d/maintenance/9425-dependabot-ioredis-major.md new file mode 100644 index 0000000000..56c00ce70b --- /dev/null +++ b/changelog.d/maintenance/9425-dependabot-ioredis-major.md @@ -0,0 +1 @@ +- **chore(ci):** stopped dependabot from grouping `ioredis` majors with routine production bumps — the package is resolved through a dynamic import in the distributed quota store, so a breaking major passes build, typecheck and both test suites and only surfaces at runtime for operators running Redis-backed quota ([#9425](https://github.com/diegosouzapw/OmniRoute/pull/9425))