chore(ci): add .github/dependabot.yml — group + ignore-major policy (vendored npm + AutoMapper) [DRAFT for jsboige scope arbitration] - #910
Merged
Conversation
…vendored npm + AutoMapper) No dependabot.yml existed in the repo; dependabot was running on GitHub UI/auto-detected config and produced ~34 PRs in a single cycle (mostly the same package bumped across many vendored 2sxc module trees — e.g. loader-utils x5, json5 x4, braces x2). This adds an explicit config encoding the policy ai-01 dispatched (`3zhzkb`): 1. nuget (our .NET pipeline) -> group + ignore AutoMapper majors (license barrier) 2. npm vendored DNNPlatform trees -> group + ignore majors (unvalidated in CI) 3. npm our trees (CardPen, pdf-val) -> group + ignore majors Why groups: collapses multiple same-directory bumps into ONE pull request (N-per-dir -> 1-per-dir). Why ignore-major on npm vendored: a major bump edits package.json in a tree that nothing in CI builds or consumes — #901 (webpack-dev-server 5->6 in Bootstrap 4 Instant) is the canonical case ai-01 held for exactly this reason. Patch/minor are lockfile-only no-ops, merged per precedent #120. Why ignore-major on AutoMapper: 14.0.0 is the LAST MIT release; 15.0.0+ flips to RPL-1.5 / commercial (Lucky Penny). Pinned by decision jsboige 2026-06-23 (#588); ignoring the major at the source stops dependabot re-proposing the commercial line (#887). Directories are enumerated exactly because dependabot does NOT glob directories — each block targets one path. The vendored list (26 trees) is generated from `find package-lock.json`, not hand-typed (gen script in scratchpad). OPEN AS A PR — NOT merged. Scope is a deliberate jsboige arbitration (see PR body, option A vs B). Co-Authored-By: Claude-Code <noreply@anthropic.com>
42 tasks
3 tasks
jsboige
added a commit
that referenced
this pull request
Jul 26, 2026
…der said "NOT merged" (#936) The file landed on master in #910 still carrying its pre-merge header: "OPEN AS A PR — NOT merged. Deliberate jsboige arbitration on scope". Both halves are now false — it is merged, and the arbitration returned. Replaces that line with the decision actually taken (jsboige, interactive, 2026-07-26): option A — keep the 26 vendored 2sxc/DNN npm trees under dependabot surveillance, grouped, majors filtered. Security patches and minors keep arriving; only majors are suppressed. Also notes that #901 (webpack-dev-server 5->6, the motivating case cited in the comment) was closed out-of-policy under this very rule, and documents the escape hatch: a CVE fixable only by a vendored major means dropping the `ignore` for that one directory here, not merging the major around the policy. Comments only — YAML re-validated, 29 update blocks unchanged. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Jul 26, 2026
jsboige
added a commit
that referenced
this pull request
Jul 26, 2026
…ot bumps (#942) (#943) The first grouped nuget PR under the #910 policy (#941) bundled 24 updates, three of which move packages CLAUDE.md pins for licence or runtime reasons: QuestPDF 2022.12.12 -> 2026.7.1 SkiaSharp.NativeAssets.Win32 2.88.6 -> 4.150.1 Microsoft.Playwright 1.43.0 -> 1.61.0 QuestPDF is the load-bearing one, and it is measured, not assumed. NuGet catalog, 2026-07-26: questpdf 2022.12.12 licenseExpression = "MIT" questpdf 2026.7.1 licenseExpression = (none), licenseUrl = aka.ms/deprecateLicenseUrl i.e. the embedded <license type="file"> form — the exact mechanism #905 identified as invisible to expression-only scanners (same shape as FluentAssertions 8.x). The #905 release gate reports "24/24 permissive" by reading those SPDX expressions, so merging #941 would remove the evidence that gate stands on, days after it passed as a #134 gate. Skia and Playwright are compatibility pins, majors only: Skia is QuestPDF's native backend and must move with it; Playwright 1.43.0 is what the CI Test step has been launching real Chromium with since #911, mirror-fallback included. Deliberately NOT a blanket major filter on .NET. Grouping is all-or-nothing, so the list names only pins that are already-recorded decisions (#588, #905, CLAUDE.md "Stable Dependency Versions"); everything else keeps flowing and is triaged on merit. Newtonsoft 13.0.3->13.0.4, PdfPig, dotNetRdf, CsvHelper and the rest of #941 remain available for a deliberate tested pass after the tag. Validated: 29 update blocks preserved, schemastore dependabot-2.0 PASS. Refs #942, #905, #910, #941 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
jsboige
added a commit
that referenced
this pull request
Jul 26, 2026
… no-op, OWLSharp major breaks the build (#947) The first grouped nuget PR under the #910 policy (#941) was superseded by dependabot itself with #945, and #945 is the measurement that shows two defects in the pin list merged as #943. 1. The Microsoft.Playwright entry was `update-types: ["version-update:semver-major"]`, which is a NO-OP for that package: it has never left the 1.x line (1.0 -> 1.61), so a semver-major update cannot fire. #945 proposed 1.43.0 -> 1.61.0 as a MINOR and the filter let it through. Found by po-2024's review on #945, confirmed firsthand against the PR's package delta. Now pinned on ALL update types, like QuestPDF. An ignore entry is only as strong as the package's versioning scheme. 2. OWLSharp / OWLSharp.Extensions 4.x -> 5.x breaks the build: 10 compile errors, all in Ontology/OwlAdapter.cs, all `RDFResource` -> `OWLNamedIndividual` (SKOSHelper changed its signatures). The try/catch fallbacks around those five call sites guard runtime, not compile, so the build never reaches the 638 tests. OWLSharp was deliberately left unpinned as "a major to test on its merits after the tag"; #945 ran that test and the answer is "needs an API migration", now issue #946 with its DoD. The pin is the corollary of that scheduled work, not a way to silence a red build. Also recorded, both deliberately NOT changed: - dotNetRdf stays unpinned. The #945 review first attributed the OwlAdapter break to dotNetRdf 3.3.2 -> 3.5.2; re-measured, that is wrong (VDS.RDF is used elsewhere in the file, the bump is a minor, and RDFSharp.RDFResource is the type our code passes, not the one that moved). Pinning it would have been an over-pin bought on a mis-attribution. - SkiaSharp keeps major-only. #945 delivered 2.88.6 -> 2.88.9, a patch inside the 2.88.x line QuestPDF 2022.12.12 links against — the pin working as intended, not a leak. Labels nuget / npm / vendored created in the repo: they were referenced by this file but did not exist, so dependabot posted a "labels could not be found" comment on all 27 open PRs. Noted in the header so they are not deleted without editing the config. Refs #942, #945, #946 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the repo's first
dependabot.yml, encoding the policy ai-01 dispatched (3zhzkb). Not for merge as-is — scope is a deliberate jsboige arbitration (option A vs B below). Dispatched by ai-01; authored by po-2024 (tick 113).Why now
No
dependabot.ymlexisted in the repo. Dependabot was running on GitHub's auto-detected config and produced ~34 PRs in a single cycle — almost entirely the same package bumped across many vendored 2sxc module trees (loader-utils ×5, json5 ×4, braces ×2, svgo ×3, postcss ×3…). The coordinator triaged all 34 last cycle and extracted two real signals (#871 Magick.NET, #887 AutoMapper) from the noise. This config makes that triage structural instead of ad-hoc.The policy (3 sections)
groupsignore/patterns: ["*"](batch)/Generation/CardPen,/docs/investigations/pdf-validationpatterns: ["*"]/DNNPlatform/...patterns: ["*"]groupscollapses multiple same-directory bumps into ONE PR (N-per-dir → 1-per-dir).ignoremajors on npm vendored: a major editspackage.jsonin a tree that nothing in CI builds or consumes — chore(deps): Bump webpack-dev-server from 5.2.6 to 6.0.0 in /DNNPlatform/Portals/_default/Skins/Bootstrap 4 Instant #901 (webpack-dev-server 5→6 inBootstrap 4 Instant) is the canonical case ai-01 held for exactly this reason. Patch/minor stay lockfile-only no-ops, merged per precedent fix(security): Resolve all Dependabot security alerts #120.ignoreAutoMapper majors: 14.0.0 is the LAST MIT release; 15.0.0+ flips to RPL-1.5/commercial (Lucky Penny). Pinned by decision jsboige 2026-06-23 (build: close NU1903 (AutoMapper CVE) while staying on the last free MIT version #588). Ignoring the major at the source stops dependabot re-proposing the commercial line (Bump AutoMapper from 14.0.0 to 15.1.3 #887).Validation
jsonschema,$refresolved).yaml.safe_load).find package-lock.json, not hand-typed) — 1 nuget + 2 our-npm + 26 vendored-npm.🔀 jsboige arbitration — option A vs B
Section 3 (26 vendored blocks) is the decision. Two defensible policies:
Option A — keep monitoring, grouped + ignore-major (embodied in this PR; ai-01's "batcher les lockfiles vendorés" intent). Preserves the security signal from vendored deps;
groupscuts the volume from ~34 PRs/cycle to ≤26 (one per tree, weekly). Precedent fix(security): Resolve all Dependabot security alerts #120 (merge no-op vendored bumps) treats the signal as worth keeping. Cost: 26 near-identical blocks; new 2sxc modules aren't auto-covered (must add a block); file is 609 lines.Option B — stop monitoring the vendored trees (leaner). They are upstream DNN/2sxc vendor templates — not our code, not built or consumed by any CI workflow, and ai-01's chore(deps): Bump webpack-dev-server from 5.2.6 to 6.0.0 in /DNNPlatform/Portals/_default/Skins/Bootstrap 4 Instant #901 reasoning ("rien en CI ne la valide ni consomme") argues they shouldn't generate work for us at all. Security of vendored deps is the upstream's responsibility. Cost: lose the transitive-vuln signal on vendored deps (mitigation: rely on the upstream DNN/2sxc advisories, and the real pipeline — nuget — stays monitored).
My recommendation: Option B is the more honest fit for the repo's actual build surface, but Option A is shipped here because ai-01's dispatch named the "batcher" policy. If jsboige picks B, section 3 is the tail of the file — delete from the
# --- 3. npm: vendoredmarker to EOF and the config is correct (1 nuget + 2 our-npm). One command:Either way, sections 1–2 (nuget pipeline + our own npm trees) are unambiguous and should land.
Schedule / limits
open-pull-requests-limit10 (nuget) / 5 (our npm) / 3 (vendored).commit-messageprefixchore(deps)with scope; labelsdependencies+ ecosystem (+vendoredfor section 3).Out of scope
Refs #901 (vendored major hold), #887/#588 (AutoMapper license pin), #120 (vendored no-op precedent), #458 TRACK 5.
🤖 po-2024 — dispatched by ai-01 (
3zhzkb)