From 17d07df8106328514593ab37cbe4915214af3507 Mon Sep 17 00:00:00 2001 From: bgard68 <30295154+bgard68@users.noreply.github.com> Date: Sun, 13 Sep 2026 09:14:22 -0500 Subject: [PATCH] build(deps): group the vitest packages across all update types The npm entry grouped ["minor", "patch"] only, so a major bypassed the group and arrived one pull request per package. @vitest/coverage-v8 pins vitest with an exact peer, so that split produced two branches that could never go green: #182 and #183, each failing `npm ci` with ERESOLVE against the other's version. github-actions is already grouped across all update types in this file for precisely this reason - codeql-action's sub-actions must match, and that holds regardless of bump size. The vitest pair has the same property, so it gets the same treatment. Listed before the catch-all group, because Dependabot assigns a dependency to the first group whose patterns match it. Co-Authored-By: Claude Opus 5 --- .github/dependabot.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 7486c3c..c089e68 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -154,6 +154,17 @@ updates: interval: "weekly" open-pull-requests-limit: 5 groups: + # vitest and @vitest/coverage-v8 pin each other with an exact peer dependency: + # coverage-v8@X requires vitest@X precisely. A major therefore cannot arrive as two + # pull requests - each one alone makes `npm ci` unsatisfiable, so both branches are + # born red and no rebase helps. That is what #182 and #183 were, and #189 is the + # single commit that had to replace them. + # + # Grouped across ALL update types, for the same reason github-actions is: the + # constraint holds whether the bump is major, minor or patch. It is listed before + # the catch-all because Dependabot puts a dependency in the FIRST group it matches. + vitest: + patterns: ["vitest", "@vitest/*"] npm: patterns: ["*"] update-types: ["minor", "patch"]