From 8ef3447950bbd5197846ebff64065932c1c34bf2 Mon Sep 17 00:00:00 2001 From: Diego Rodrigues de Sa e Souza Date: Tue, 1 Sep 2026 15:54:04 -0300 Subject: [PATCH] chore(deps): freeze onnxruntime-node and eslint-plugin-react-hooks out of dependabot groups (#12329) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit onnxruntime-node only ever moves paired with @huggingface/transformers (already frozen, #9962/#4050) — a solo bump breaks the single-copy ABI contract test and reds every production-group PR. eslint-plugin-react-hooks stays pinned to 7.0.1 by a contract test until the 7.1.1 rule set is adopted in its own PR (the #12146 migration completed today, so that adoption is now unblocked). --- .github/dependabot.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 3dfad903a7..7bc6b338e4 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -58,6 +58,22 @@ updates: # on the VPS — so keep auto-bumps frozen (no update-types = ignore every version). # Migrate it intentionally, not via dependabot (#4050). - dependency-name: "@huggingface/transformers" + # onnxruntime-node is the OTHER HALF of the @huggingface/transformers pair frozen + # above: the hoisted copy must equal the exact version transformers pins, or npm + # nests a second ABI-incompatible native copy (contract test + # tests/unit/onnxruntime-single-copy.test.ts, pair established in #9962). A solo + # bump can never be correct — it only ever moves together with transformers, in + # the same deliberate migration PR. Freezing it keeps the production group PRs + # (e.g. #12219) from being born red on the pair contract. + - dependency-name: "onnxruntime-node" + # eslint-plugin-react-hooks is pinned to 7.0.1 by a contract test + # (tests/unit/eslint-react-hooks-version-pinned.test.ts) until the 7.1.1 rule set + # is adopted deliberately — that adoption needs a full cold lint run and its own + # PR (the #12146 react-hooks migration finished on 2026-09-01, so the path is + # open; the bump still must not ride a dependabot group, where it reds the + # development group PRs, e.g. #12220). Remove this ignore in the adoption PR + # together with the pin test. + - dependency-name: "eslint-plugin-react-hooks" - package-ecosystem: "github-actions" directory: "/"