From eb4e0264b0478c753794d5000b36590994760d45 Mon Sep 17 00:00:00 2001 From: NishanthNixx Date: Mon, 31 Aug 2026 21:23:07 +0530 Subject: [PATCH] chore(deps): ignore two majors Dependabot cannot land safely MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both of these open weekly, go green, and are not mergeable. Green CI is misleading in each case because the thing that breaks is not in CI. eslint 10 (#333): eslint-config-next 16.3.3 (latest) still depends on eslint-plugin-react ^7.37.0, and the newest eslint-plugin-react (7.37.5) declares peer eslint "^9.7". Under eslint 10 it throws "TypeError: Error while loading rule 'react/display-name': contextOrFilename.getFilename is not a function" on every file in both apps — linting does not run at all. eslint-config-next's own peer range is >=9.0.0, so pnpm installs it cleanly and the failure only appears at lint time; lint is deliberately not in CI, so the PR reports green. Verified locally against the PR branch on 2026-08-31. tauri-action v1 (#328): release.yml only runs on pushes to `release`, so this action is never exercised by a PR — a bad bump surfaces in the middle of a real ~200-minute signed macOS release. v1 removes `updaterJsonKeepUniversal` and switches latest.json asset URLs to GitHub API URLs, whose embedded asset IDs belong to this repo; the mirror step rewrites URLs by string-replacing the repo slug, so those would survive the rewrite pointing at assets that do not exist in the mirror repo. Both ignores are scoped to majors and carry the condition for removal. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c05bea1e..3b5f3f8a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,6 +7,16 @@ updates: groups: actions: patterns: ["*"] + ignore: + # tauri-action v1 is a breaking release and release.yml never runs on a + # PR, so a bump here lands untested and only fails during a real ~200-min + # signed macOS release. v1 removes `updaterJsonKeepUniversal` and moves + # latest.json asset URLs to GitHub API URLs, whose embedded asset IDs + # belong to this repo — the mirror step's slug rewrite would produce URLs + # pointing at assets that do not exist in the mirror repo. Migrate by + # hand against a throwaway tag, then drop this ignore. + - dependency-name: tauri-apps/tauri-action + update-types: ["version-update:semver-major"] - package-ecosystem: npm directory: / @@ -16,6 +26,18 @@ updates: groups: minor-and-patch: update-types: ["minor", "patch"] + ignore: + # eslint 10 cannot be installed yet: eslint-config-next (16.3.3, latest) + # still depends on eslint-plugin-react ^7.37.0, whose newest release + # (7.37.5) declares peer eslint "^9.7" and crashes under v10 with + # "TypeError: Error while loading rule 'react/display-name': + # contextOrFilename.getFilename is not a function" on every file, in both + # apps. eslint-config-next's own peer range says >=9.0.0, so the install + # resolves cleanly and only fails at lint time — and lint is not in CI, + # so the PR goes green. Drop this ignore once eslint-plugin-react ships + # eslint 10 support. Verified 2026-08-31. + - dependency-name: eslint + update-types: ["version-update:semver-major"] - package-ecosystem: cargo directory: /apps/desktop/src-tauri