Repository navigation
ci(deps): group dependabot updates by what installs together - #559
Conversation
The open Dependabot PRs for the pinned `@angular/*` packages cannot install individually: each peer-depends on its siblings by exact version, so apache#521, apache#522 and apache#542 each fail `npm install` with ERESOLVE on their own and resolve only when moved together. Group the npm ecosystem by the families that release in lockstep — angular, ionic, linting, testing, ngx-translate and types — with a catch-all that batches minor and patch bumps for everything else and leaves majors to arrive individually. `typescript` sits in the angular group because its blocker is `@angular/build`'s `typescript >=6.0 <6.1` peer rather than the linters, which is what fails apache#312. Group github-actions the same way, with codeql split out: Dependabot treats `github/codeql-action/init` and `github/codeql-action/analyze` as separate dependencies (apache#517 and apache#518), so the two steps that share one pinned SHA are bumped by two PRs today. Grouping is not a fix for an upstream cap, and the config comments say so: apache#516 (eslint 10) fails alone and still fails with the whole linting group resolved at latest, because eslint-plugin-import 2.32.0 is the newest release and caps at eslint ^9. Signed-off-by: Aman Mittal <aman.mittal3052000@gmail.com>
E2E — mocked backend🎭 E2E Tests✅ All green — 363 passed · 0 failed · 1 skipped · 1 known-failing, across 30 spec files in 6m 48s. 🔒 Known failuresMarked
By spec file
All 365 tests — click to expand
Slowest 10 — what the shard counts should be tuned against
📼 Download the HTML report, videos and traces — see the Generated by run 35503432389 from |
E2E — real Fineract🎭 E2E Tests✅ All green — 78 passed · 0 failed · 0 skipped, across 24 spec files in 6m 13s. By spec file
All 78 tests — click to expand
Slowest 10 — what the shard counts should be tuned against
📼 Download the HTML report, videos and traces — see the Generated by run 35503432389 from |
What and why
.github/dependabot.ymlhad nogroups, so Dependabot opened one PR per package. The pinned@angular/*packages peer-depend on each other by exact version, so those PRs are uninstallable alone and sit unmerged. This adds groups to both ecosystems, drawn from the families that actually fail to resolve individually rather than from a guess at what looks related.Closes #558
Verification
Each open Dependabot PR's
package.jsonwas applied toapache/mainand resolved withnpm install --package-lock-only(resolution only — no build or test run), alone and then grouped with its family:@angular/common22.1.0 → 22.1.1@angular/common@22.1.1peers@angular/core@"22.1.1", found 22.1.0@angular/core22.1.0 → 22.1.4@angular/animations@22.1.0peers@angular/core@"22.1.0"@angular/compiler-cli22.1.0 → 22.1.4@angular/compiler-cli@22.1.4peers@angular/compiler@"22.1.4", found 22.1.0@ngx-translate/core17 → 18eslint9 → 10eslint-plugin-import@2.32.0peerseslint "… ^9"typescript6.0.3 → 7.0.2@angular/buildpeerstypescript ">=6.0 <6.1"The grouped Angular run moved every exact-pinned
@angular/*package to 22.1.4 together and installed cleanly. A baseline run of unmodifiedapache/maininstalls, confirming the failures above come from the bumps and not the harness.Group membership was then checked by replaying Dependabot's first-match-wins glob matching over all 39 entries in
package.jsonand over everyuses:in.github/workflows/— nothing falls through ungrouped, andcodeqlclaims both codeql-action subpaths before the catch-all sees them.npx prettier --check .github/dependabot.ymlpasses.Screenshots
Not applicable — CI configuration only.
Two things the evidence changed
typescriptis grouped with Angular, not with the linters. The peer that rejects TypeScript 7 in build(deps-dev): bump typescript from 6.0.3 to 7.0.2 #312 is@angular/build'stypescript >=6.0 <6.1, nottypescript-eslint, so a TypeScript bump has to move with the Angular packages.Grouping cannot fix build(deps-dev): bump eslint from 9.39.5 to 10.9.1 #516 or build(deps-dev): bump typescript from 6.0.3 to 7.0.2 #312, and the config comments say so. build(deps-dev): bump eslint from 9.39.5 to 10.9.1 #516 fails alone and still fails with the entire linting family resolved at latest, because
eslint-plugin-import@2.32.0is the newest published release and caps ateslint ^9. Both PRs are blocked on upstream releases, not on how Dependabot batches them. If the weekly noise is unwanted in the meantime,ignoreentries are the tool — happy to add them here or in a follow-up, scoped so they lift when the caps do.@ngx-translate/*is the one group not backed by a resolution failure, and it is commented as such in the file: #207 installs alone becausehttp-loader@17declares no peer oncore. It is grouped becausehttp-loader@18peers@ngx-translate/core >=18.0.0, so a lonecorebump produces a silent version skew rather than an error. Straightforward to drop if the preference is to keep the config strictly ERESOLVE-driven.applies-tois left at its default ofversion-updates, so security updates continue to open one focused PR each instead of waiting for a weekly group.AI assistance (optional)
npm install --package-lock-onlylocally against each PR's manifest; the group membership check was a local script replaying Dependabot's glob matching.Checklist
src/app/api/.src/app/core/adapters/instead of direct browser globals or imperative third-party APIs. — Not applicable; no application code changed..github/dependabot.ymlis consumed by GitHub, not by this repo's test runners, so there is nothing to assert against in CI. It was verified out of band as described under Verification.