[devin-ai-integration]

SUMMARY

Audits the temporary npm ignore clauses for /superset-frontend/ in .github/dependabot.yml (issue #5) and prunes the ones whose blockers no longer hold, so Dependabot can resume proposing upgrades. Each remaining ignore now has a documented owner/exit condition.

Findings per rule:

Rule	Original reason	Current state	Action
@rjsf/* (undocumented)	React 18 constraint (apache#37976)	@rjsf/* v6 declares peerDependencies.react: ">=18" and the repo is already on the latest 6.6.2, so the React-18 blocker is resolved	Removed
react-icons (# TODO … until React >= 19)	Pin from apache#38144	No longer a direct dependency in any superset-frontend package.json, so the rule is orphaned (Dependabot only manages direct deps); latest react-icons also declares react: "*", not >=19	Removed
jest-environment-jsdom	jsdom v30 incompatible with Jest v30	Still valid; lacked an explicit exit condition/owner	Kept + added exit condition and owner
@swc/plugin-transform-imports	Webpack-SWC hybrid + Lodash tree-shaking	Still valid; already has source link + TODO exit	Kept as-is
react-checkbox-tree (major)	pmmmwh/react-refresh-webpack-plugin#940 / apache#39600	Still valid; already has links + exit condition	Kept as-is
@babel/* (major)	Babel 8 ecosystem blocker	Still valid; already has detailed reasoning + exit	Kept as-is

Net diff removes the two stale entries and adds an exit-condition note to jest-environment-jsdom:

     ignore:
-      - dependency-name: "@rjsf/*"
-      # TODO: remove below entries until React >= 19.0.0
-      - dependency-name: "react-icons"
       # JSDOM v30 doesn't play well with Jest v30
       # Source: https://jestjs.io/blog#known-issues
       # GH thread: https://github.com/jsdom/jsdom/issues/3492
+      # Exit condition: drop this ignore once jest-environment-jsdom ships a
+      # release built on a jsdom line that Jest 30 supports (see the jsdom
+      # issue above); owner: frontend build/test maintainers.
       - dependency-name: "jest-environment-jsdom"

Note: dropping @rjsf/* and react-icons only lets Dependabot propose future upgrades for maintainer review; nothing is auto-merged. If maintainers prefer to keep major @rjsf bumps gated, a version-update:semver-major ignore can be re-added.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

N/A — config-only change.

TESTING INSTRUCTIONS

• python3 -c "import yaml; yaml.safe_load(open('.github/dependabot.yml'))" parses cleanly.
• pre-commit run --files .github/dependabot.yml passes (check yaml green).

ADDITIONAL INFORMATION

• Has associated issue: Closes Audit and prune temporary Dependabot ignore rules #5
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

Link to Devin session: https://app.devin.ai/sessions/445b31ada26846c48230ff7d12009912

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring