chore(dependabot): hold the three coupled dependency groups behind their issues - #616
Merged
Merged
Conversation
…eir issues #607 grouped 34 updates into one PR; nine of them cross a channel boundary or break a stated pin, and were split out into #611 / #612 / #613 rather than merged. Nothing stops dependabot re-proposing the same nine next cycle, in a group where they look like ordinary bumps again. That matters most for the PDFtoImage / SkiaSharp pair, which dependabot got wrong the first time: it proposed native assets 4.151.2 against a PDFtoImage version that resolves SkiaSharp to 4.150.1. The build stayed green - the mismatch only surfaces when the Linux container loads native assets - so the only thing that caught it was the comment recording the invariant. A second pass at the same proposal would look equally clean. The text-extraction group is held whole rather than by semver: PdfPig, DocumentFormat.OpenXml and ClosedXML are pinned to the exact versions ElBruno.MarkItDotNet 0.6.0 pulls transitively, so bumping any of them alone leaves a pin describing a version nothing justifies. MarkItDotNet is pre-1.0, so its minors carry the conversion-behaviour changes too. ModelContextProtocol holds only the major; 1.x patches still flow. Each entry names its issue, and says to lift it when that issue closes rather than when the version looks safe.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#607 grouped 34 updates into one PR. Nine cross a channel boundary or break a stated pin and were split out into #611 / #612 / #613 rather than merged (#610 took the other twenty-six). Nothing currently stops dependabot re-proposing those nine next cycle, in a group where they look like ordinary bumps again.
That matters most for the PDFtoImage / SkiaSharp pair, which dependabot got wrong the first time: native assets
4.151.2against a PDFtoImage version that resolves SkiaSharp to4.150.1. CI stayed green — the mismatch only surfaces when the Linux container loads native assets — so the only thing that caught it was the comment recording the invariant. A second pass at the same proposal would look equally clean, and the reviewer would need to remember.What is held, and why at that granularity
ModelContextProtocol,ModelContextProtocol.AspNetCore>= 2.0.0— the major only; 1.x patches still flowElBruno.MarkItDotNet(.Excel),PdfPig,DocumentFormat.OpenXml,ClosedXMLPDFtoImage,SkiaSharp.NativeAssets.LinuxThe text-extraction group is held whole rather than by semver because the three companions are pinned to the exact versions
ElBruno.MarkItDotNet 0.6.0pulls transitively — bumping any one alone leaves a pin describing a version nothing justifies. MarkItDotNet is pre-1.0, so its minors carry conversion-behaviour changes rather than just fixes, and those fail as wrong Markdown rather than as exceptions.Each entry names its issue and says to lift it when that issue closes, rather than when the version happens to look safe.
Related
typescriptwas added to the npm ignores in #614 for the same class of reason — a package whose usable range is dictated by something npm cannot see. Dependabot has since re-proposed the Angular group without it (#615), green.