Conversation
|
a9c3abc was deployed to: https://fred-pr1925.review.mdn.allizom.net/ |
| - package-ecosystem: npm | ||
| directory: /vendor/yari/client/pwa | ||
| schedule: | ||
| interval: weekly | ||
| open-pull-requests-limit: 10 | ||
| cooldown: | ||
| default-days: 3 | ||
| groups: | ||
| npm-prod: | ||
| dependency-type: production | ||
| update-types: | ||
| - minor | ||
| - patch | ||
| npm-dev: | ||
| dependency-type: development | ||
| update-types: | ||
| - minor | ||
| - patch | ||
| commit-message: | ||
| prefix: chore | ||
| include: scope | ||
|
|
||
| - package-ecosystem: npm | ||
| directory: /vendor/yari/libs/play | ||
| schedule: | ||
| interval: weekly | ||
| open-pull-requests-limit: 10 | ||
| cooldown: | ||
| default-days: 3 | ||
| groups: | ||
| npm-prod: | ||
| dependency-type: production | ||
| update-types: | ||
| - minor | ||
| - patch | ||
| npm-dev: | ||
| dependency-type: development | ||
| update-types: | ||
| - minor | ||
| - patch | ||
| commit-message: | ||
| prefix: chore | ||
| include: scope |
There was a problem hiding this comment.
I wonder if we intentionally left these out?
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| include: scope | ||
|
|
||
| - package-ecosystem: npm | ||
| directory: /vendor/yari/client/pwa |
There was a problem hiding this comment.
These two new entries (/vendor/yari/client/pwa here, /vendor/yari/libs/play on line 97) target manifests that fred never installs, so every PR Dependabot opens for them will change versions that have no effect on the build.
Fred consumes the vendored source and resolves its dependencies from the root package.json:
rspack.config.js:602bundles./vendor/yari/client/pwa/src/service-worker.tsas a fred rspack entry, andserver.js:18imports./vendor/yari/libs/play/index.jsdirectly.- Root
package.jsondeclares noworkspaces, and.github/workflows/_build.yml:99,.github/workflows/test.yml:32and:83only runnpm ciat the root — nothing installsvendor/yari/client/pwa/yarn.lockorvendor/yari/libs/play/package-lock.json. - The real versions are the root ones:
@zip.js/zip.js,dexie,heand@types/heare all declared in rootpackage.json.
The pins have already drifted, which confirms the vendored manifests are dead weight: vendor/yari/client/pwa/package.json pins dexie 4.0.11 and @zip.js/zip.js 2.7.71, while the root declares ^4.4.6 and ^2.15.0. The pwa's webpack, webpack-cli and ts-loader devDependencies are also unused, since rspack does the bundling.
Remove both entries and keep the vendored code covered by the root / npm entry. Note also that neither new entry carries the root entry's typescript >=7 ignore rule, so they would open TypeScript 7 PRs that the root entry is deliberately suppressing.
AI-generated review by Claude
There was a problem hiding this comment.
Ah, that explains it.
This branch has not been deployed
2 participants
Description
Aligns the Dependabot configuration with the MDN defaults:
open-pull-requests-limit: 10on thegithub-actionsentry and thenpmentrygithub-actionsentry and thenpmentrynpmentries for/vendor/yari/client/pwaand/vendor/yari/libs/playMotivation
Ensures consistent dependency update configuration across all MDN repositories.
Additional details
See also: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
Related issues and pull requests
Part of #1445.