From b3827de201f2c266583e950e2162359c51469251 Mon Sep 17 00:00:00 2001 From: Piyal Basu Date: Mon, 6 Jul 2026 21:20:14 -0400 Subject: [PATCH 1/2] chore(dependabot): stop opening PRs for major version bumps Grouping all majors into one PR meant a single migration-heavy major (e.g. jest 30 / babel 8) held ~40 trivially-safe majors hostage in one perpetually-red PR that could never merge as-is. Rather than trade that for a stream of one-PR-per-major, adopt freighter-mobile's posture: don't open version-update PRs for majors at all (ignore version-update:semver-major for every dependency). Majors become deliberate, human-initiated upgrades. Unaffected: - minor/patch version updates (still grouped, still weekly w/ 7d cooldown) - Dependabot SECURITY updates -- per GitHub docs, `ignore` update-types apply only to version updates, so a vulnerability that needs a major bump still gets a security PR. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/dependabot.yml | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index dc6e87a891..8429b73690 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -18,16 +18,22 @@ updates: # being younger than 7 days. Note: security updates ignore cooldown. cooldown: default-days: 7 + # Do not open version-update PRs for major bumps -- they are almost always + # breaking-change migrations that don't belong in routine currency churn + # (mirrors freighter-mobile's security-only posture). Minor/patch currency + # is unaffected, and per GitHub docs an `ignore` update-type only applies + # to version updates -- Dependabot SECURITY updates are still created for + # major bumps when a vulnerability requires one. + ignore: + - dependency-name: "*" + update-types: + - "version-update:semver-major" groups: minor-and-patch: applies-to: version-updates update-types: - "patch" - "minor" - major: - applies-to: version-updates - update-types: - - "major" security: applies-to: security-updates patterns: From d82f04db41c2483a3fcbf5b9e5b5bbd39ddae511 Mon Sep 17 00:00:00 2001 From: Piyal Basu Date: Fri, 28 Aug 2026 12:48:06 -0400 Subject: [PATCH 2/2] chore(dependabot): correct the rationale comment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review on #2900: the comment claimed this "mirrors freighter-mobile's security-only posture" while the config keeps minor/patch version updates enabled. Contradictory as written. Checking what freighter-mobile actually does makes it worse than a wording slip: that repo has no .github/dependabot.yml at all. Version updates require a config file, security updates do not — so mobile gets security updates only by omission, not by a deliberate posture. Its 9 dependabot PRs are npm_and_yarn group bumps, which is what security updates look like. So there is no parity to claim, and the comparison was misleading in both directions: it implied mobile made a choice it did not make, and implied this config matches a posture it deliberately does not match. Rewritten to state what this config does — drop semver-major version updates, keep minor/patch, leave security updates untouched — and to record the difference from freighter-mobile explicitly, so the next reader does not re-derive it. Comment-only: the parsed YAML is identical before and after. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8429b73690..d0b1162402 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -19,11 +19,18 @@ updates: cooldown: default-days: 7 # Do not open version-update PRs for major bumps -- they are almost always - # breaking-change migrations that don't belong in routine currency churn - # (mirrors freighter-mobile's security-only posture). Minor/patch currency - # is unaffected, and per GitHub docs an `ignore` update-type only applies - # to version updates -- Dependabot SECURITY updates are still created for - # major bumps when a vulnerability requires one. + # breaking-change migrations that don't belong in routine currency churn. + # Minor/patch currency is unaffected and still opens PRs. + # + # Per GitHub docs an `ignore` update-type applies to version updates only, + # so Dependabot SECURITY updates are still created for major bumps when a + # vulnerability requires one. + # + # NOT the same as freighter-mobile, despite an earlier version of this + # comment saying so. That repo has no dependabot.yml at all, which disables + # version updates entirely and leaves only security updates -- it is + # security-only by omission rather than by choice. This config deliberately + # keeps minor/patch version updates; only majors are dropped. ignore: - dependency-name: "*" update-types: