From 6b7ab478f6f2751bf9780bf5054bf4c7e295d0fc Mon Sep 17 00:00:00 2001 From: Roland Date: Sat, 3 Oct 2026 10:21:44 -0600 Subject: [PATCH] dependabot: move major-version exclusions into the config Comment-based ignores did not survive the last config change, and the SQLAlchemy rule only blocked majors while 1.4 (the 2.0 transition release) slipped into the python group. Hold SQLAlchemy <1.4, alembic <1.11, cachetools majors (mru_cache removed in 6), and the npm majors that each need a migration branch: maplibre-gl 6, react-dropzone 15+, React 19, TypeScript 6+, Mantine 9. Co-Authored-By: Claude Fable 5.1 --- .github/dependabot.yml | 34 ++++++++++++++++++++++++++++++---- 1 file changed, 30 insertions(+), 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d0fb177e..dcb91909 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -8,12 +8,15 @@ updates: target-branch: "master" open-pull-requests-limit: 5 ignore: - # alembic >=1.11 requires SQLAlchemy 2; requirements.txt pins SQLAlchemy 1.3. - # Grouped PRs containing it fail to install, so hold alembic until the - # SQLAlchemy 2 migration lands. + # SQLAlchemy 1.4 is the 2.0 transition release and is not a drop-in + # change for this codebase; alembic >=1.11 requires SQLAlchemy 2. + # Hold both until the SQLAlchemy 2 migration lands. + - dependency-name: "SQLAlchemy" + versions: [">=1.4"] - dependency-name: "alembic" versions: [">=1.11"] - - dependency-name: "SQLAlchemy" + # cachetools 6 removed cachetools.func.mru_cache, still used by modules/zim. + - dependency-name: "cachetools" update-types: ["version-update:semver-major"] groups: python-dependencies: @@ -45,6 +48,29 @@ updates: interval: "monthly" target-branch: "master" open-pull-requests-limit: 5 + ignore: + # Major upgrades below need their own migration branch, not a bump PR. + # maplibre-gl 6: /map build depends on pinned babel/terser handling. + - dependency-name: "maplibre-gl" + versions: [">=6"] + # react-dropzone 15+ changed the accept API; 20 requires Node >=22. + - dependency-name: "react-dropzone" + versions: [">=15"] + # React 19: @react-three/fiber 8 pins react <19. + - dependency-name: "react" + update-types: ["version-update:semver-major"] + - dependency-name: "react-dom" + update-types: ["version-update:semver-major"] + - dependency-name: "@types/react" + update-types: ["version-update:semver-major"] + - dependency-name: "@types/react-dom" + update-types: ["version-update:semver-major"] + # TypeScript 6+/7 breaks the react-scripts toolchain. + - dependency-name: "typescript" + versions: [">=6"] + # Mantine 9: all @mantine packages move together with app code changes. + - dependency-name: "@mantine/*" + update-types: ["version-update:semver-major"] groups: npm-dependencies: patterns: