From 6c2408dd39652f36955c47e3e40697b6f9620f41 Mon Sep 17 00:00:00 2001 From: Ruben van der Linde Date: Sun, 30 Aug 2026 20:38:35 +0200 Subject: [PATCH] chore(dependabot): hold back the four majors that cannot be adopted Dependabot re-proposes these on every run, and each one takes `npm ci` or `npm run build` from green to red with no code change in this repository that can fix it. Closing the pull requests does nothing: without an ignore rule they come straight back. Each is blocked by a package we do not control, verified against the registry rather than assumed: - typescript 7 typescript-eslint hard-throws on TS >= 7 (a `versionMajor >= 7` guard in its dist/index.js) and every published version still peers `typescript: ">=4.8.4 <6.1.0"`. - webpack-cli 7 @nextcloud/webpack-vue-config 7.0.4, the LATEST, peers `webpack-cli: ^6.0.1`. - @babel/core 8 the same package peers `@babel/core: ^7.22.9`. - @babel/preset-env preset-env 8 requires core 8, so the pair moves together or not at all. Splitting them is what broke filinq. These are COMPATIBILITY limits, not security ones. `npm audit` reports no advisory against any version pinned here, so holding them costs no exposure. Lift each the moment its blocker ships support. Deliberately NOT held: stylelint 17, vitest 4 and pinia 4. All three were blocked earlier today and all three are now adoptable, so dependabot should keep proposing them. --- .github/dependabot.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c5a4bdb2..2b68f06e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -34,6 +34,32 @@ updates: schedule: interval: "weekly" open-pull-requests-limit: 10 + # HELD BACK DELIBERATELY, not out of caution. Each of these is blocked by a + # package we do not control, and dependabot cannot see that, so it proposes + # them on every run and each one takes `npm ci` or `npm run build` from + # green to red with no code change that can fix it. + # + # typescript 7: typescript-eslint hard-throws on TS >= 7 (a `versionMajor + # >= 7` guard in its dist/index.js) and every published + # version still peers `typescript: ">=4.8.4 <6.1.0"`. + # webpack-cli 7: @nextcloud/webpack-vue-config 7.0.4, the latest, peers + # `webpack-cli: ^6.0.1`. + # @babel/core 8: the same package peers `@babel/core: ^7.22.9`, and + # preset-env 8 requires core 8, so the pair moves together + # or not at all. + # + # Lift each the moment its blocker ships support. These are compatibility + # limits, not security ones: `npm audit` reports no advisory against any of + # the versions pinned here. + ignore: + - dependency-name: "typescript" + update-types: ["version-update:semver-major"] + - dependency-name: "webpack-cli" + update-types: ["version-update:semver-major"] + - dependency-name: "@babel/core" + update-types: ["version-update:semver-major"] + - dependency-name: "@babel/preset-env" + update-types: ["version-update:semver-major"] cooldown: default-days: 1 include: