mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
865cfa0e87
typescript-eslint pins a hard upper bound on its typescript peer (8.64.0 → ">=4.8.4 <6.1.0"). A major TS bump violates it, so the failure is not one check — it is the whole toolchain at once. #7068 is the demonstration: dependabot grouped typescript ^6→^7 with six harmless dev bumps (@types/node, eslint, fast-check, knip, prettier, typescript-eslint) and turned Build, Lint, Quality Ratchet, Unit (6/8, 8/8), Integration (1/2, 2/2) and dast-smoke red in a single PR. The six innocuous updates were blocked by the one that could never pass. Ignoring the major lets the rest of the group flow on its own. TS majors are a toolchain migration and deserve their own PR and their own CI run — not a weekly automated attempt that cannot succeed until typescript-eslint widens the peer. Refs #7068
71 lines
2.9 KiB
YAML
71 lines
2.9 KiB
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
commit-message:
|
|
prefix: "deps"
|
|
open-pull-requests-limit: 10
|
|
groups:
|
|
production:
|
|
dependency-type: "production"
|
|
development:
|
|
dependency-type: "development"
|
|
ignore:
|
|
- dependency-name: "react"
|
|
update-types: ["version-update:semver-major"]
|
|
- dependency-name: "react-dom"
|
|
update-types: ["version-update:semver-major"]
|
|
- dependency-name: "next"
|
|
update-types: ["version-update:semver-major"]
|
|
- dependency-name: "eslint"
|
|
update-types: ["version-update:semver-major"]
|
|
- dependency-name: "eslint-config-next"
|
|
update-types: ["version-update:semver-major"]
|
|
# typescript majors are peer-blocked by typescript-eslint, which pins a hard
|
|
# upper bound (8.64.0 → peerDependencies.typescript ">=4.8.4 <6.1.0"). A TS 7
|
|
# bump therefore violates the peer and takes down the whole toolchain at once —
|
|
# #7068 grouped it with 6 harmless bumps and turned Build + Lint + Quality Ratchet
|
|
# + Unit (6/8, 8/8) + Integration (1/2, 2/2) + dast-smoke red in one shot, blocking
|
|
# the innocuous updates riding along with it. Un-ignore once typescript-eslint
|
|
# widens the peer, and migrate TS majors intentionally (own PR, own CI run).
|
|
- dependency-name: "typescript"
|
|
update-types: ["version-update:semver-major"]
|
|
# jscpd v5 is a Rust rewrite (native binary, no Node.js programmatic API).
|
|
# scripts/check/check-duplication.mjs is deliberately pinned to jscpd@4 (it
|
|
# parses jscpd-report.json against a frozen baseline). A v5 major would break
|
|
# the duplication gate — migrate the gate intentionally, not via dependabot.
|
|
- dependency-name: "jscpd"
|
|
update-types: ["version-update:semver-major"]
|
|
# @huggingface/transformers is HARD-PINNED at 3.5.2 (exact, no caret) — FROZEN.
|
|
# It is load-bearing for the LLMLingua ONNX compression engine (open-sse/services/
|
|
# compression/engines/llmlingua/ — worker.ts pins @huggingface/transformers@3.5.2)
|
|
# and for local memory embeddings (src/lib/memory/embedding/transformersLocal.ts),
|
|
# and was VPS-validated at 3.5.2 (#4014). 4.x breaks both, and even 3.x minors must
|
|
# be re-validated on the VPS — so freeze ALL auto-bumps (no update-types = ignore
|
|
# every version). Migrate it intentionally, not via dependabot (#4050).
|
|
- dependency-name: "@huggingface/transformers"
|
|
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
|
|
- package-ecosystem: "npm"
|
|
directory: "/electron"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
commit-message:
|
|
prefix: "deps"
|
|
|
|
- package-ecosystem: "docker"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
commit-message:
|
|
prefix: "deps"
|