mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-13 22:32:04 +00:00
Marc-André Bombeck
c2ac1428e5
Next 16.4.0, pg-boss 12.37.1, the AWS SDK 3.1146, @napi-rs/canvas 1.0.10, @node-rs/argon2 2.2.2, @simplewebauthn/server 14.0.3, TanStack Query and Virtual, lucide-react, mmdb-lib, nodemailer, otpauth, pg, radix-ui, react-day-picker, react-hook-form, tailwind-merge and yaml. pg-boss moves its schema from 42 to 45 (three additive migrations, nullable columns and one partial index, no table rewrite); the worker applies them on start as before. The retention test pins the installed version, so it moves to 12.37.1 after re-checking every source line it asserts. zod stays on 4.4.3. 4.5 requires seconds in `z.iso.datetime()` and 4.6 rewrites nullable unions in the generated JSON Schema into `type` arrays, which reshapes the OpenAPI document and the MCP tool schemas. Dependabot skips zod 4.5 and later until that move is made on purpose.
75 lines
3.0 KiB
YAML
75 lines
3.0 KiB
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
security-patches:
|
|
applies-to: security-updates
|
|
update-types:
|
|
- "patch"
|
|
# One weekly pull request per dependency kind instead of a trickle of
|
|
# single bumps: patch and minor updates travel together and pass the
|
|
# same checks once. Majors stay single so each gets its own review.
|
|
production-weekly:
|
|
dependency-type: "production"
|
|
update-types:
|
|
- "patch"
|
|
- "minor"
|
|
development-weekly:
|
|
dependency-type: "development"
|
|
update-types:
|
|
- "patch"
|
|
- "minor"
|
|
ignore:
|
|
# zod 4.5 made `z.iso.datetime()` require seconds, so a request carrying
|
|
# `2026-01-01T06:15Z` that passes today would be refused with a 422 on
|
|
# every route that validates a timestamp, and 4.6 rewrites nullable and
|
|
# primitive unions in the generated JSON Schema from `anyOf` to `type`
|
|
# arrays, which reshapes the OpenAPI document and every MCP tool schema.
|
|
# Both are contract changes for the web client, the iOS app and MCP
|
|
# callers, not a routine bump, so the move past 4.4 gets its own change
|
|
# with the timestamp producers audited. Patch releases on 4.4 still
|
|
# arrive.
|
|
- dependency-name: "zod"
|
|
versions: [">=4.5.0"]
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
groups:
|
|
# init, analyze and upload-sarif are one release pinned in three places.
|
|
# Bumped separately, a run mixes two versions and analyze refuses the
|
|
# config init wrote ("Loaded a configuration file for version 4.37.7, but
|
|
# running version 4.37.9"), so none of the single-action pull requests can
|
|
# reach green on its own. They travel together.
|
|
codeql-action:
|
|
patterns:
|
|
- "github/codeql-action*"
|
|
- package-ecosystem: "docker"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
# The `docker` ecosystem above reads the Dockerfile only. The bundled
|
|
# database lives in `docker-compose.yml`, which GitHub treats as its own
|
|
# ecosystem, so without this block a new PostgreSQL minor release never
|
|
# reaches us and the pin ages silently.
|
|
- package-ecosystem: "docker-compose"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
ignore:
|
|
# A PostgreSQL major is a migration, not an update: the on-disk format
|
|
# changes, so the operator has to run pg_upgrade or dump and restore.
|
|
# The first run of this ecosystem proposed 16.15 -> 18.6, which would
|
|
# have handed self-hosters a database their data directory cannot be
|
|
# read by. Minor releases still arrive as PRs; a major is a deliberate
|
|
# project decision with a migration guide behind it.
|
|
- dependency-name: "postgres"
|
|
update-types: ["version-update:semver-major"]
|