Haozhe Wu
218d453859
caio: aiofile 3.11.1 (latest) requires caio~=0.9.0, so bumping caio to 0.10.x makes pip unresolvable and the grouped PR fails CI. Ignore only caio, not the whole minor/patch group. @vitejs/plugin-react 6.x peers vite@^8 (we are on 6.x) and @testing-library/jest-dom 7.x requires Node >=22 (CI/Docker use 20). Both are migrations, not dependency bumps.
61 lines
2.4 KiB
YAML
61 lines
2.4 KiB
YAML
version: 2
|
|
updates:
|
|
# Root Python project (pyproject.toml).
|
|
- package-ecosystem: "pip"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 4
|
|
groups:
|
|
# Minor/patch bumps are low-risk and reviewed as a single batch; majors
|
|
# are excluded so they still arrive individually and get real scrutiny
|
|
# (a batched PR mixing 10 patch bumps with 1 breaking major is worse
|
|
# than either alone — you can't reject just the major).
|
|
pip-minor-patch:
|
|
applies-to: version-updates
|
|
update-types: ["minor", "patch"]
|
|
ignore:
|
|
# pandas 3.x has real breaking changes (Copy-on-Write always-on, removed
|
|
# deprecated APIs) we haven't vetted; the <3.0.0 ceiling is deliberate,
|
|
# not an oversight. Revisit as a dedicated migration, not a dep bump.
|
|
- dependency-name: "pandas"
|
|
update-types: ["version-update:semver-major"]
|
|
# caio is capped by our own dependency tree, not by choice: aiofile
|
|
# 3.11.1 (latest) requires caio~=0.9.0, so any bump to caio 0.10.x makes
|
|
# `pip install` unresolvable. Dependabot kept proposing it and the group
|
|
# PR failed CI with ResolutionImpossible. Drop this ignore once aiofile
|
|
# ships a release that accepts caio 0.10.
|
|
- dependency-name: "caio"
|
|
|
|
# Frontend npm dependencies.
|
|
- package-ecosystem: "npm"
|
|
directory: "/frontend"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 4
|
|
groups:
|
|
npm-minor-patch:
|
|
applies-to: version-updates
|
|
update-types: ["minor", "patch"]
|
|
ignore:
|
|
# Both majors are blocked on infrastructure migrations we have not done,
|
|
# so they can only sit red. Same rationale as the pandas pin above:
|
|
# revisit each as a dedicated migration, not a dependency bump.
|
|
# @vitejs/plugin-react 6.x peers vite@^8 (we are on vite 6.x).
|
|
# @testing-library/jest-dom 7.x requires Node >=22 (CI/Docker use 20).
|
|
- dependency-name: "@vitejs/plugin-react"
|
|
update-types: ["version-update:semver-major"]
|
|
- dependency-name: "@testing-library/jest-dom"
|
|
update-types: ["version-update:semver-major"]
|
|
|
|
# GitHub Actions workflow pins.
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 4
|
|
groups:
|
|
actions-minor-patch:
|
|
applies-to: version-updates
|
|
update-types: ["minor", "patch"]
|