mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 12:32:43 +00:00
Marc-André Bombeck
ff0a81154c
With 16.4.0 a document sheet opened through ?doc= stays open after Back, and the [ / ] day keys sometimes leave ?day= where it was. Three end-to-end journeys fail 3 of 40 repeated runs on 16.4.0 and 0 of 80 on 16.3.8 with every other update in place, and CI hit the same journeys on both viewports. 16.3.8 already carries every published security fix, so Dependabot skips 16.4.0 for next and the two packages that move with it.
87 lines
3.7 KiB
YAML
87 lines
3.7 KiB
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
security-patches:
|
|
applies-to: security-updates
|
|
update-types:
|
|
- "patch"
|
|
# One weekly pull request per dependency kind instead of a trickle of
|
|
# single bumps: patch and minor updates travel together and pass the
|
|
# same checks once. Majors stay single so each gets its own review.
|
|
production-weekly:
|
|
dependency-type: "production"
|
|
update-types:
|
|
- "patch"
|
|
- "minor"
|
|
development-weekly:
|
|
dependency-type: "development"
|
|
update-types:
|
|
- "patch"
|
|
- "minor"
|
|
ignore:
|
|
# zod 4.5 made `z.iso.datetime()` require seconds, so a request carrying
|
|
# `2026-01-01T06:15Z` that passes today would be refused with a 422 on
|
|
# every route that validates a timestamp, and 4.6 rewrites nullable and
|
|
# primitive unions in the generated JSON Schema from `anyOf` to `type`
|
|
# arrays, which reshapes the OpenAPI document and every MCP tool schema.
|
|
# Both are contract changes for the web client, the iOS app and MCP
|
|
# callers, not a routine bump, so the move past 4.4 gets its own change
|
|
# with the timestamp producers audited. Patch releases on 4.4 still
|
|
# arrive.
|
|
- dependency-name: "zod"
|
|
versions: [">=4.5.0"]
|
|
# Next 16.4.0 breaks URL state after history traversal: with a sheet
|
|
# opened through `?doc=`, Back leaves it open, and `[` / `]` sometimes
|
|
# do not move `?day=`. Reproduced in three end-to-end journeys (3 of 40
|
|
# repeated runs on 16.4.0, 0 of 80 on 16.3.8 with everything else
|
|
# equal). 16.3.8 carries every published security fix, so the line
|
|
# waits for a 16.4 patch; the two packages that move with it wait too.
|
|
- dependency-name: "next"
|
|
versions: ["16.4.0"]
|
|
- dependency-name: "eslint-config-next"
|
|
versions: ["16.4.0"]
|
|
- dependency-name: "@next/bundle-analyzer"
|
|
versions: ["16.4.0"]
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
groups:
|
|
# init, analyze and upload-sarif are one release pinned in three places.
|
|
# Bumped separately, a run mixes two versions and analyze refuses the
|
|
# config init wrote ("Loaded a configuration file for version 4.37.7, but
|
|
# running version 4.37.9"), so none of the single-action pull requests can
|
|
# reach green on its own. They travel together.
|
|
codeql-action:
|
|
patterns:
|
|
- "github/codeql-action*"
|
|
- package-ecosystem: "docker"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
# The `docker` ecosystem above reads the Dockerfile only. The bundled
|
|
# database lives in `docker-compose.yml`, which GitHub treats as its own
|
|
# ecosystem, so without this block a new PostgreSQL minor release never
|
|
# reaches us and the pin ages silently.
|
|
- package-ecosystem: "docker-compose"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
ignore:
|
|
# A PostgreSQL major is a migration, not an update: the on-disk format
|
|
# changes, so the operator has to run pg_upgrade or dump and restore.
|
|
# The first run of this ecosystem proposed 16.15 -> 18.6, which would
|
|
# have handed self-hosters a database their data directory cannot be
|
|
# read by. Minor releases still arrive as PRs; a major is a deliberate
|
|
# project decision with a migration guide behind it.
|
|
- dependency-name: "postgres"
|
|
update-types: ["version-update:semver-major"]
|