Skip to content

ci: restrict Dependabot to compatible updates - #54

Merged
AbubakarMahmood merged 1 commit into
mainfrom
codex/dependabot-compatible-updates-only
Jul 28, 2026
Merged

ci: restrict Dependabot to compatible updates#54
AbubakarMahmood merged 1 commit into
mainfrom
codex/dependabot-compatible-updates-only

Conversation

@AbubakarMahmood

Copy link
Copy Markdown
Owner

Summary

  • ignore SemVer-major NuGet version updates for every dependency
  • remove the unsupported NuGet dependency-type: development group filter
  • constrain the Microsoft/Asp.Versioning group to minor and patch updates

Why

PR #53 grouped 20 packages, including breaking MudBlazor, OpenAPI, Npgsql, MediatR, FluentValidation, and test-tooling majors. Its build failed with 26 compile errors. GitHub's current Dependabot schema does not support dependency-type grouping for NuGet, so the intended test-only filter was ignored.

Security updates remain eligible; compatible minor/patch version proposals remain enabled.

Validation

  • parsed .github/dependabot.yml with PyYAML
  • asserted wildcard major ignore, bounded group update types, and removal of the invalid group
  • git diff --check

Copilot AI review requested due to automatic review settings July 28, 2026 18:54

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@AbubakarMahmood
AbubakarMahmood merged commit e144f3d into main Jul 28, 2026
2 checks passed
@AbubakarMahmood
AbubakarMahmood deleted the codex/dependabot-compatible-updates-only branch July 28, 2026 18:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants