wrolpi/.github/dependabot.yml
lrnselfreliance 0d2431c41a
dependabot: move major-version exclusions into the config (#760)
Comment-based ignores did not survive the last config change, and the
SQLAlchemy rule only blocked majors while 1.4 (the 2.0 transition
release) slipped into the python group. Hold SQLAlchemy <1.4, alembic
<1.11, cachetools majors (mru_cache removed in 6), and the npm majors
that each need a migration branch: maplibre-gl 6, react-dropzone 15+,
React 19, TypeScript 6+, Mantine 9.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
2026-10-03 10:21:50 -06:00

80 lines
2.5 KiB
YAML

version: 2
updates:
# Python - root (requirements.txt)
- package-ecosystem: "pip"
directory: "/"
schedule:
interval: "monthly"
target-branch: "master"
open-pull-requests-limit: 5
ignore:
# SQLAlchemy 1.4 is the 2.0 transition release and is not a drop-in
# change for this codebase; alembic >=1.11 requires SQLAlchemy 2.
# Hold both until the SQLAlchemy 2 migration lands.
- dependency-name: "SQLAlchemy"
versions: [">=1.4"]
- dependency-name: "alembic"
versions: [">=1.11"]
# cachetools 6 removed cachetools.func.mru_cache, still used by modules/zim.
- dependency-name: "cachetools"
update-types: ["version-update:semver-major"]
groups:
python-dependencies:
patterns:
- "*"
update-types:
- "patch"
- "minor"
# Python - controller
- package-ecosystem: "pip"
directory: "/controller"
schedule:
interval: "monthly"
target-branch: "master"
open-pull-requests-limit: 5
groups:
controller-dependencies:
patterns:
- "*"
update-types:
- "patch"
- "minor"
# npm - app
- package-ecosystem: "npm"
directory: "/app"
schedule:
interval: "monthly"
target-branch: "master"
open-pull-requests-limit: 5
ignore:
# Major upgrades below need their own migration branch, not a bump PR.
# maplibre-gl 6: /map build depends on pinned babel/terser handling.
- dependency-name: "maplibre-gl"
versions: [">=6"]
# react-dropzone 15+ changed the accept API; 20 requires Node >=22.
- dependency-name: "react-dropzone"
versions: [">=15"]
# React 19: @react-three/fiber 8 pins react <19.
- dependency-name: "react"
update-types: ["version-update:semver-major"]
- dependency-name: "react-dom"
update-types: ["version-update:semver-major"]
- dependency-name: "@types/react"
update-types: ["version-update:semver-major"]
- dependency-name: "@types/react-dom"
update-types: ["version-update:semver-major"]
# TypeScript 6+/7 breaks the react-scripts toolchain.
- dependency-name: "typescript"
versions: [">=6"]
# Mantine 9: all @mantine packages move together with app code changes.
- dependency-name: "@mantine/*"
update-types: ["version-update:semver-major"]
groups:
npm-dependencies:
patterns:
- "*"
update-types:
- "patch"
- "minor"