From f16f0cfc5c700da424f48d9cef4bc778578a8e0b Mon Sep 17 00:00:00 2001 From: ww8l Date: Sat, 22 Aug 2026 09:15:05 -0600 Subject: [PATCH] Dependabot: group minor and patch only, majors on their own MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The first grouped run put ten cargo bumps in one PR, three of them breaking majors — sqlx 0.8->0.9, reqwest 0.12->0.13, md-5 0.10->0.11 — producing 24 compile errors on all three platforms. The seven harmless updates were stuck behind migrations nobody had scheduled, and all the PR could report was that the batch was broken. Grouping by ecosystem was the wrong axis. The useful split is whether a human has to think: minor and patch batch up and merge on a green tick, majors arrive alone and correctly attributed and wait until someone wants to do the work. Per-ecosystem limits raised so the individual majors are not starved by the group. sqlx 0.9 is a real piece of work, not a bump: it introduces SqlStr and rejects format!-built query strings outright ("dynamic SQL strings should be audited for possible injections"), which is 21 of those 24 errors and takes in CHANNEL_COLUMNS. Noted while diagnosing: the glib moderate advisory cannot be fixed by any dependency PR here. glib is transitive under the whole GTK stack that Tauri uses for its Linux backend, so it moves when Tauri does. No security fix is blocked behind the sqlx migration. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01JaRQYbdzNiZaN4cbY5VFMx --- .github/dependabot.yml | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 00a0046..fe0ba92 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -2,41 +2,44 @@ # 2,000 quota-minute cap made them expensive, and restored the same day once # the repo went public and standard runners became free. # -# The cost is gone; the noise was real. The first run of the old config opened -# eight PRs in one morning, because three ecosystems each filled a separate -# per-package cap. Everything is grouped now, so a month's updates arrive as at -# most one PR per ecosystem — three, not eight. +# Grouping is minor+patch ONLY, deliberately. The first grouped run put ten +# cargo bumps in one PR, three of them breaking majors — sqlx 0.8->0.9, +# reqwest 0.12->0.13, md-5 0.10->0.11 — and 24 compile errors. The seven +# harmless updates were stuck behind migrations nobody had scheduled, and the +# PR could only say "the batch is broken". # -# The trade for grouping: a red PR tells you something in the batch broke, not -# which one. That is the right way round here. CI runs on these PRs again (the -# dependabot[bot] guard in ci.yml is gone), so breakage is caught before a -# release carries it, and splitting a bad group by hand is rarer work than -# triaging eight PRs a month. +# Majors therefore arrive as their own PRs. A routine batch merges on a green +# tick; a breaking change shows up alone, correctly attributed, and waits until +# someone wants to do the work. That is the split worth having: not by +# ecosystem, but by whether a human has to think. version: 2 updates: - package-ecosystem: npm directory: "/" schedule: interval: monthly - open-pull-requests-limit: 2 + open-pull-requests-limit: 5 groups: npm: patterns: ["*"] + update-types: ["minor", "patch"] - package-ecosystem: cargo directory: "/src-tauri" schedule: interval: monthly - open-pull-requests-limit: 2 + open-pull-requests-limit: 5 groups: cargo: patterns: ["*"] + update-types: ["minor", "patch"] - package-ecosystem: github-actions directory: "/" schedule: interval: monthly - open-pull-requests-limit: 1 + open-pull-requests-limit: 3 groups: actions: patterns: ["*"] + update-types: ["minor", "patch"]