🏗️🚮：stop dependabot duplicating renovate - #1807
Merged
DerekNonGeneric merged 2 commits intoAug 13, 2026
Merged
Conversation
DerekNonGeneric
force-pushed
the
chore/dependency-cooldowns
branch
from
August 13, 2026 01:20
34729b1 to
5b38f8f
Compare
DerekNonGeneric
force-pushed
the
chore/stop-dependabot-duplicating-renovate
branch
from
August 13, 2026 01:20
8f75ed5 to
4815ba2
Compare
DerekNonGeneric
force-pushed
the
chore/dependency-cooldowns
branch
from
August 13, 2026 02:35
5b38f8f to
b51d7fd
Compare
DerekNonGeneric
force-pushed
the
chore/stop-dependabot-duplicating-renovate
branch
from
August 13, 2026 02:35
4815ba2 to
f5f4a89
Compare
DerekNonGeneric
changed the title
DerekNonGeneric
changed the base branch from
chore/dependency-cooldowns
to
live
August 13, 2026 03:17
`{ matchUpdateTypes: [...] }` with no settings beneath it applies no
configuration -- package rules select what config attaches to, they do
not decide what gets updated. Removing it changes no behaviour;
renovate-config-validator is as happy after as before.
Assisted-by: Claude-Code:claude-opus-5
Both were configured for npm, and dependabot has opened 560 pull requests here; #1700 has been sitting open since October. Narrowing it to what renovate misses leaves nothing: renovate extracted 98 dependencies from eleven files, including every manifest dependabot could have been pointed at -- the workflows, the dev container's Dockerfile and its features, .nvmrc, and package.json. Security updates are unaffected. They are a repository setting rather than a file, and both are on. Assisted-by: Claude-Code:claude-opus-5
DerekNonGeneric
force-pushed
the
chore/stop-dependabot-duplicating-renovate
branch
from
August 13, 2026 03:18
f5f4a89 to
fb06c1d
Compare
✅ Deploy Preview for gh-pages-openinf ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This was referenced Aug 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two pieces of renovate/dependabot config that were not doing what they looked like they were doing. Stacked on #1805, which touches both files.
The package rule that set nothing
A package rule selects what configuration attaches to; it does not decide what gets updated. With no settings beneath it, this applied nothing at all. It reads as though it were meant to scope automerge, but
automerge: trueis set at the top level andgroupName: "all"puts everything in one pull request anyway, so per-update-type scoping could not have worked as written.Removed.
renovate-config-validatoris as happy after as before — it never complained, which is why this survived.Narrowing dependabot leaves nothing to narrow to
You asked me to point dependabot at what renovate misses. I ran renovate locally to find out rather than guess:
It extracted 98 dependencies from 11 package files:
package.json,pnpm-workspace.yaml.devcontainer/Dockerfile.devcontainer/devcontainer.json(all three features).nvmrcdprint.json,.devcontainer/post-create.shThat is every manifest dependabot could have been pointed at, including the two I thought might be gaps. The
devcontainermanager is enabled by default and reads feature references directly, soghcr.io/devcontainers/features/*was never uncovered.So the honest narrowing is to zero, and the file goes. Dependabot had opened 560 pull requests against this repository; #1700 has been open since October.
Security updates are unaffected. They are a repository setting, not a file —
automated-security-fixesreports{"enabled": true, "paused": false}and vulnerability alerts return 204.dependabot.ymlonly ever governed version updates.Note
This makes the dependabot commit in #1805 moot — it adds a cooldown to a file this deletes. I left #1805 alone rather than force-push a branch you are reviewing. Say the word and I will drop that commit from it instead; merging both in order is harmless either way.
One thing genuinely uncovered, left alone
Neither bot reads option values inside a dev container feature, only the feature reference. So
"version": "21"in the java feature is unmanaged — renovate will offerjava:1→java:2but never Java 21 → 25. A custom regex manager could pick it up, the waydprint.jsonandpost-create.shalready do.I did not add one: with
automerge: truein force, a manager watching a JDK major would automerge a runtime change under vnu-jar, which is not a thing to switch on quietly. Worth doing deliberately if you want it.