From 024adfeb58b5704ea8513a774fb646568d33ee35 Mon Sep 17 00:00:00 2001 From: Erik Darling <2136037+erikdarlingdata@users.noreply.github.com> Date: Sat, 25 Jul 2026 18:08:41 -0400 Subject: [PATCH] Hold Repl packages to patch bumps only #388 brought Repl, Repl.Mcp and Repl.Testing onto dev at 0.11.0. They are pre-1.0, where a minor bump is allowed to break under semver - and Dependabot classifies 0.11 -> 0.12 as a *minor*, so the config's usual "majors get their own PR, minor/patch are grouped" split gives no protection at all here. A breaking bump would arrive inside a routine grouped batch. That matters more than for a typical dependency because the app ships an auto-updater, so whatever lands reaches users without them choosing it. Ignores semver-major and semver-minor for the three packages; patch bumps still flow so genuine fixes arrive. Mirrors the existing ignore rules for the other deliberate pins. Co-Authored-By: Claude Fable 5 --- .github/dependabot.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5c780aa..6edf97e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -80,6 +80,25 @@ updates: # one is handled by hand. - dependency-name: "Velopack" + # Repl / Repl.Mcp / Repl.Testing (#388) are pre-1.0. Under semver a 0.x + # minor bump is allowed to break, and Dependabot classifies 0.11 -> 0.12 + # as a *minor*, so the usual "majors only get their own PR" split does not + # protect anything here. Patch bumps still flow, so genuine fixes arrive. + # This matters more than for a normal dependency: the app ships an + # auto-updater, so a breaking bump reaches users without them choosing it. + - dependency-name: "Repl" + update-types: + - version-update:semver-major + - version-update:semver-minor + - dependency-name: "Repl.Mcp" + update-types: + - version-update:semver-major + - version-update:semver-minor + - dependency-name: "Repl.Testing" + update-types: + - version-update:semver-major + - version-update:semver-minor + - package-ecosystem: github-actions target-branch: dev directory: "/"