Repository navigation
chore(deps): ignore major NuGet bumps (keep minor/patch + security) - #229
Conversation
… + security) Major NuGet bumps (e.g. Stripe.net 50->52) are breaking and need manual review + testing, not auto-PRs. Ignore version-update:semver-major globally so only grouped minor/patch version updates open automatically; scoping the ignore to major version-updates leaves Dependabot security updates intact. GitHub Actions grouped. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
This is a clean Dependabot configuration hardening: NuGet major-version bumps are now suppressed via version-update:semver-major (the correct scoping string, which leaves security advisories unaffected per Dependabot's documented behavior), and GitHub Actions updates are collapsed into a single grouped PR each week. The YAML structure is valid, the ignore and groups blocks are complementary and non-conflicting, and the removal of the explicit open-pull-requests-limit on the actions entry is safe because grouping keeps steady-state at 1 PR and the GitHub default of 5 applies as a backstop. No correctness, security, contract, or CLAUDE.md issues found.
|
Change
The backend isn't Expo-locked, so NuGet minor/patch version updates stay useful — but major bumps (e.g. Stripe.net 50→52) are breaking and need manual review + billing tests, not an auto-PR.
dependency-name: "*",version-update:semver-major). Scoping the ignore to majors keeps Dependabot security updates flowing.Paired with the npm security-only change in orbit-ui-mobile (its mobile workspace is Expo-SDK-pinned and install-managed).
🤖 Generated with Claude Code