Repository navigation
Dependabot: group minor/patch updates + apply the pending safe bumps in one change - #75
Merged
Merged
Conversation
A re-scan after the last dependabot.yml change produced twenty pull requests at once, because Dependabot opens one per package AND per project, plus a combined "multi" one for the same change (for example Microsoft.EntityFrameworkCore.Design 8.0.32 came as six pull requests). Each one then conflicted with the others on neighbouring lines of the same project files. Add a catch-all group "minor-and-patch" (patterns "*", update types minor and patch) after the existing opentelemetry / serilog / masstransit / test-tooling groups. Dependabot puts a package into the first group that matches, so the specific groups keep their own pull request and everything else lands in one, spanning every project in the solution. Majors are never grouped: each stays a separate pull request to be judged (and the ignore rules still drop the ones that need a decision: Microsoft.*, System.*, MassTransit, Swashbuckle, ...). The README's Dependabot paragraph describes the grouping. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Vuhzoey6h5V9wPPVFuR7ME
Six Dependabot pull requests (#48/#69, #50, #53, #54, #57, #60) touch the same project files on neighbouring lines, so merging one made the next conflict, and each needed its own rebase and CI run. Apply their seventeen version changes together instead: - Microsoft.EntityFrameworkCore.Design 8.0.8 -> 8.0.32 (Identity, Inventory, Order, Payment, Product) - Microsoft.Extensions.Diagnostics.HealthChecks.EntityFrameworkCore 8.0.8 -> 8.0.32 (same five projects) - Grpc.AspNetCore 2.80.0 -> 2.84.0 (Inventory, Order); Grpc.Tools 2.80.0 -> 2.84.0 (Order; Inventory already has it) - Microsoft.AspNetCore.Authentication.OpenIdConnect 8.0.8 -> 8.0.32 (Gateway) - Microsoft.EntityFrameworkCore.InMemory 8.0.27 -> 8.0.32 (unit tests) - System.Text.Json 8.0.5 -> 8.0.6 (Shared, integration tests) The values are taken from the Dependabot branches themselves, no other package is touched. Dependabot closes its own pull requests once the versions are on main. Verified: solution builds with CI=true (NuGet audit findings are errors), 0 errors; unit suite 198 passed, 0 failed, 6 skipped (they need RabbitMQ). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Vuhzoey6h5V9wPPVFuR7ME
NullButCute
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
1. Group Dependabot's minor/patch updates (commit 1)
A re-scan after the last
dependabot.ymlchange produced twenty pull requests at once: Dependabot opens one per package and per project, plus a combined "multi" one, and they conflict with each other on neighbouring lines of the same project files.New group in the NuGet section, listed after
opentelemetry/serilog/masstransit/test-tooling(a package goes into the first group that matches):One PR for all other minor/patch updates across every project. Majors are never grouped; the ignore rules still drop the ones that need a decision. README updated.
2. Apply the pending safe bumps now (commit 2)
Merging the open Dependabot PRs one by one kept producing conflicts (#53 was 39 minutes behind
main), each needing a rebase and a CI run. This applies their seventeen version changes together — the values are read from the Dependabot branches, nothing else is touched:Verified locally: solution builds with
CI=true(NuGet audit findings are errors) — 0 errors; unit suite 198 passed, 0 failed, 6 skipped (need RabbitMQ).After merging this
Dependabot's PRs for these versions (#48, #50, #53, #54, #57, #60, #62–#64, #66, #67, #69–#74) become no-ops and are closed by Dependabot itself — close any that remain. Still open on purpose: #61 (MassTransit 8.2.5 → 8.5.11, same major, needs its own test) and #65/#68 (StackExchange.Redis 2 → 3, major: close).
🤖 Generated with Claude Code
https://claude.ai/code/session_01Vuhzoey6h5V9wPPVFuR7ME