fix(deps): reorder dependency risk badges, fix hung-fetch classification bug - #135
Merged
wgordon17 merged 3 commits intoAug 18, 2026
Merged
Conversation
Adds "digest" as a distinct DepCategory (previously folded into "patch") and reorders CATEGORY_SORT_ORDER to maintenance -> pin -> digest -> patch -> minor -> major -> other, matching Renovate's documented digest/patch/ minor/major ordering (renovatebot/renovate#10217). Fixes depCategory()'s fallback for unparseable PRs, which was defaulting to "maintenance" (verified via a real production PR) instead of "other" - silently sorting unknown-risk PRs into the safest slot. Also closes a related gap in the label-based fallback, which checked major/minor/patch labels but never digest/pin/maintenance. Extends DependencyFiltersSchema's updateType enum to include "digest" before shipping the new filter option, avoiding a localStorage schema mismatch that would otherwise wipe all view state on next load.
Extends extractVersionInfo() with three new patterns for Renovate
title phrasings not yet covered: Rust crate updates ("update [rust]
crate X to vY"), Docker tag updates ("update X Docker tag to vY",
verified against real production titles from backstage/mastodon/
Kyoo - depName comes before "Docker tag" per Renovate's
commitMessageTopic template), and a generic single-target fallback
("update X to vY") for any remaining manager not explicitly covered.
All three patterns guard the captured "to" value with a version-shape
check, matching the existing depMatch/actionMatch patterns, so a
non-version target (e.g. "latest") correctly falls through to null
instead of producing a nonsensical result - letting the body-fetch
fallback classify it instead.
Fixes the root cause of dependency PRs permanently losing their type badges mid-session: fetchDepPRBodies/fetchDashboardIssueBodies had no timeout on their GraphQL calls. A hung request (suspected: octokit's throttling/retry queue stalling before fetch() dispatches) meant the awaited promise never settled, so DashboardPage's fetch-in-progress gate booleans - reset only in a finally block - never reset, blocking all future dependency-PR classification for the rest of the session. Adds a shared raceWithTimeout() helper: Promise.race against a 20s timeout + AbortController, with the timer cleared on whichever branch settles first. Promise.race is the load-bearing fix that guarantees the gate always resets; AbortController is best-effort cleanup layered on top, since it has no defined effect on a request still queued in the retry layer before fetch() is dispatched. An auth-clear race guard (getClient() === octokit) suppresses the post-timeout failure notification if the user has since logged out or re-authenticated, since the 20s window means the original session may no longer be active. Diagnostic logging is added to both functions and to DashboardPage's dep-PR-bodies effect to distinguish a genuine hang from a separate, still-open reactivity question about that effect's subscription tracking.
wgordon17
force-pushed
the
fix/dependency-tab-risk-ordering
branch
from
August 18, 2026 17:49
19590e9 to
8c90693
Compare
wgordon17
marked this pull request as ready for review
August 18, 2026 17:57
wgordon17
added a commit
that referenced
this pull request
Aug 19, 2026
…136) ## Summary - Fixes 14 findings from `/pr-review` on merged PR #135 (title-parsing pattern ordering, a shared body-fetch helper extraction, a failure-cooldown mechanism for persistently-failing GraphQL requests) plus additional gaps found by this session's own `/quality-gate` pass - Restores always-on `console.debug` diagnostics in the affected files to match this codebase's dominant logging convention and preserve the original plan's production-diagnostic strategy - Opened as a new PR since #135 was merged mid-review; branch rebased cleanly onto current `main` (including PR #129, Jira row reordering)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #133