From 22dd689bf9d773f94d768f356d2e91851abe3a93 Mon Sep 17 00:00:00 2001 From: Jakub Kasprzyk Date: Mon, 28 Sep 2026 19:15:03 +0200 Subject: [PATCH 1/2] ci(dependabot): stop duplicate and always-failing dependency PRs Dependabot scanned /, /package and /example separately, but bun.lock lives only at the root. Every bump in example/ arrived twice, and the copy from /example had no lockfile change, so `bun install --frozen-lockfile` failed in every job (#175-#177 next to #172-#174). - Scan only the root. The workspaces are updated from there. - Group Reanimated with Worklets. Worklets 0.13 alone fails pod install against Reanimated 4.6 (#173). - Put the example app's runtime dependencies in one PR. - Split dev dependencies into a minor/patch group and a major group, so the majors no longer keep the safe updates from passing (#144, #178). - Ignore majors of Expo packages, babel-preset-expo and @babel/core, which come with an Expo SDK upgrade, and TypeScript 7, which typescript-eslint rejects. - Check monthly instead of weekly, for both Bun and GitHub Actions. --- .github/dependabot.yml | 62 ++++++++++++++++++++++++++++++++++++------ 1 file changed, 53 insertions(+), 9 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5a22eec7..34c12430 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,7 +6,7 @@ updates: - package-ecosystem: github-actions directory: / schedule: - interval: weekly + interval: monthly groups: github-actions: patterns: @@ -20,24 +20,68 @@ updates: # Version updates are supported; security updates are not, so Dependabot # security alerts for these dependencies have to be acted on by hand. - package-ecosystem: bun - directories: - - / - - /package - - /example + # Only the root. `bun.lock` lives here, and a run from `/` already updates + # package/ and example/ through the workspaces. Listing those two as well + # opened a second copy of every bump without the lockfile, which fails + # `bun install --frozen-lockfile` in every job. + directory: / schedule: - interval: weekly + interval: monthly + # A dependency that matches several groups goes to the one whose pattern + # names it most exactly, so the catch-all groups keep `patterns: ['*']`. groups: + # Reanimated refuses to pod install next to a Worklets minor it does not + # support, so the two only ever move together. + reanimated: + patterns: + - react-native-reanimated + - react-native-worklets + # Runtime dependencies. Only the example app has any; the library itself + # declares peers only. + example-app: + dependency-type: production + patterns: + - '*' + # Minor and patch updates should pass as they are. Majors usually need a + # config or code change, so they get a pull request of their own instead + # of failing all the others with them. dev-dependencies: dependency-type: development + update-types: + - minor + - patch + patterns: + - '*' + dev-dependencies-major: + dependency-type: development + update-types: + - major patterns: - '*' - # React Native, React and Nitro are peer dependencies with native - # counterparts; upgrading them is a deliberate, tested change, never an - # automated bump. ignore: + # React Native, React and Nitro are peer dependencies with native + # counterparts; upgrading them is a deliberate, tested change, never an + # automated bump. - dependency-name: react - dependency-name: react-native - dependency-name: react-native-nitro-modules - dependency-name: nitrogen + # A new major of an Expo package belongs to the next Expo SDK. Moving to + # it is an SDK upgrade (`npx expo install --fix`), not a single bump. + - dependency-name: expo + update-types: ['version-update:semver-major'] + - dependency-name: 'expo-*' + update-types: ['version-update:semver-major'] + - dependency-name: '@expo/*' + update-types: ['version-update:semver-major'] + - dependency-name: babel-preset-expo + update-types: ['version-update:semver-major'] + # babel-preset-expo is built from Babel 7 plugins. + - dependency-name: '@babel/core' + update-types: ['version-update:semver-major'] + # typescript-eslint refuses to run on TypeScript 7, and TypeScript 7 no + # longer accepts `moduleResolution: node` in tsconfig.plugin.json. + - dependency-name: typescript + versions: ['>=7.0.0'] commit-message: prefix: chore From 9dd731509b5473ae3e4e0958d44350e3826f852f Mon Sep 17 00:00:00 2001 From: Jakub Kasprzyk Date: Mon, 28 Sep 2026 19:24:08 +0200 Subject: [PATCH 2/2] ci(dependabot): note that dependency-type works for bun GitHub's options reference lists `dependency-type` in groups for npm but not for bun, which reads as if the bun groups would take every dependency. dependabot-core registers the same production check for bun as for npm (bun/lib/dependabot/bun.rb), and the old dev-dependencies group here only ever took devDependencies (#144, #178) while the example app's runtime dependencies came as separate PRs (#172-#174). --- .github/dependabot.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 34c12430..8c2d84ad 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -29,6 +29,9 @@ updates: interval: monthly # A dependency that matches several groups goes to the one whose pattern # names it most exactly, so the catch-all groups keep `patterns: ['*']`. + # GitHub's options reference does not list `dependency-type` for bun, but + # Dependabot applies it with the npm rule: `dependencies` and + # `optionalDependencies` are production, everything else development. groups: # Reanimated refuses to pod install next to a Worklets minor it does not # support, so the two only ever move together.