mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-13 18:32:12 +03:00
8ef3447950
onnxruntime-node only ever moves paired with @huggingface/transformers (already frozen, #9962/#4050) — a solo bump breaks the single-copy ABI contract test and reds every production-group PR. eslint-plugin-react-hooks stays pinned to 7.0.1 by a contract test until the 7.1.1 rule set is adopted in its own PR (the #12146 migration completed today, so that adoption is now unblocked).
98 lines
4.9 KiB
YAML
98 lines
4.9 KiB
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
commit-message:
|
|
prefix: "deps"
|
|
open-pull-requests-limit: 10
|
|
groups:
|
|
production:
|
|
dependency-type: "production"
|
|
development:
|
|
dependency-type: "development"
|
|
ignore:
|
|
- dependency-name: "react"
|
|
update-types: ["version-update:semver-major"]
|
|
- dependency-name: "react-dom"
|
|
update-types: ["version-update:semver-major"]
|
|
- dependency-name: "next"
|
|
update-types: ["version-update:semver-major"]
|
|
- dependency-name: "eslint"
|
|
update-types: ["version-update:semver-major"]
|
|
- dependency-name: "eslint-config-next"
|
|
update-types: ["version-update:semver-major"]
|
|
# typescript majors are peer-blocked by typescript-eslint, which pins a hard
|
|
# upper bound (8.64.0 → peerDependencies.typescript ">=4.8.4 <6.1.0"). A TS 7
|
|
# bump therefore violates the peer and takes down the whole toolchain at once —
|
|
# #7068 grouped it with 6 harmless bumps and turned Build + Lint + Quality Ratchet
|
|
# + Unit (6/8, 8/8) + Integration (1/2, 2/2) + dast-smoke red in one shot, blocking
|
|
# the innocuous updates riding along with it. Un-ignore once typescript-eslint
|
|
# widens the peer, and migrate TS majors intentionally (own PR, own CI run).
|
|
- dependency-name: "typescript"
|
|
update-types: ["version-update:semver-major"]
|
|
# jscpd v5 is a Rust rewrite (native binary, no Node.js programmatic API).
|
|
# scripts/check/check-duplication.mjs is deliberately pinned to jscpd@4 (it
|
|
# parses jscpd-report.json against a frozen baseline). A v5 major would break
|
|
# the duplication gate — migrate the gate intentionally, not via dependabot.
|
|
- dependency-name: "jscpd"
|
|
update-types: ["version-update:semver-major"]
|
|
# ioredis is a SOFT/optional dependency loaded through a dynamic import
|
|
# (src/lib/quota/redisQuotaStore.ts — "Redis driver requires ioredis package"),
|
|
# so a breaking major never fails at build or typecheck time: the only consumers
|
|
# are the distributed quota store (redisQuotaStore.ts, storeFactory.ts) and the
|
|
# `import type Redis` in src/shared/utils/rateLimiter.ts. Nothing in the unit or
|
|
# vitest suites exercises a live Redis connection, so a v5→v6 API break would ship
|
|
# green and only surface at runtime for operators running distributed quota — the
|
|
# exact users least able to absorb it. #9310 grouped that major with 9 harmless
|
|
# bumps; majors here need their own PR and a deliberate migration review.
|
|
- dependency-name: "ioredis"
|
|
update-types: ["version-update:semver-major"]
|
|
# @huggingface/transformers is VPS-validated at ^4.2.0 (migrated intentionally in
|
|
# #9962). It is load-bearing for the LLMLingua ONNX compression engine (open-sse/
|
|
# services/compression/engines/llmlingua/ — @atjsh/llmlingua-2@2.0.5 peers on
|
|
# "@huggingface/transformers": "^3.5.2 || ^4.0.0") and for local memory embeddings
|
|
# (src/lib/memory/embedding/transformersLocal.ts). Further majors must be re-validated
|
|
# on the VPS — so keep auto-bumps frozen (no update-types = ignore every version).
|
|
# Migrate it intentionally, not via dependabot (#4050).
|
|
- dependency-name: "@huggingface/transformers"
|
|
# onnxruntime-node is the OTHER HALF of the @huggingface/transformers pair frozen
|
|
# above: the hoisted copy must equal the exact version transformers pins, or npm
|
|
# nests a second ABI-incompatible native copy (contract test
|
|
# tests/unit/onnxruntime-single-copy.test.ts, pair established in #9962). A solo
|
|
# bump can never be correct — it only ever moves together with transformers, in
|
|
# the same deliberate migration PR. Freezing it keeps the production group PRs
|
|
# (e.g. #12219) from being born red on the pair contract.
|
|
- dependency-name: "onnxruntime-node"
|
|
# eslint-plugin-react-hooks is pinned to 7.0.1 by a contract test
|
|
# (tests/unit/eslint-react-hooks-version-pinned.test.ts) until the 7.1.1 rule set
|
|
# is adopted deliberately — that adoption needs a full cold lint run and its own
|
|
# PR (the #12146 react-hooks migration finished on 2026-09-01, so the path is
|
|
# open; the bump still must not ride a dependabot group, where it reds the
|
|
# development group PRs, e.g. #12220). Remove this ignore in the adoption PR
|
|
# together with the pin test.
|
|
- dependency-name: "eslint-plugin-react-hooks"
|
|
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
|
|
- package-ecosystem: "npm"
|
|
directory: "/electron"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
commit-message:
|
|
prefix: "deps"
|
|
|
|
- package-ecosystem: "docker"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
commit-message:
|
|
prefix: "deps"
|