chore(deps): ignore react/react-dom in Dependabot (lockstep with the framework) - #280
Conversation
…tep)
Dependabot bumped react-dom to 19.2.7 while leaving react at 19.2.0, which React rejects ('Incompatible React versions') and broke all web component tests (#261). react and react-dom must move together via a coordinated upgrade, so ignore both — same rationale as the Expo SDK packages.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review: PR #280
Scope: PR #280 — chore(deps): ignore react/react-dom in Dependabot (lockstep with the framework)
Recommendation: APPROVE
Summary
This PR adds react and react-dom to the Dependabot npm ignore list, matching the existing treatment of expo/react-native packages that must also move in lockstep. The two-line change is a root-cause fix: it prevents Dependabot from bumping either package independently, eliminating the mismatch that caused all 138 web component test files to fail when react-dom was bumped to 19.2.7 while react stayed at 19.2.0. The change is correct and complete.
Findings
Critical: None
High: None
Medium: None
Low / Info: None
Subagents
parity-checker: N/A — no apps/web or apps/mobile files changed
i18n-syncer: N/A — no user-facing strings or locale files changed
contract-aligner: N/A — no packages/shared types or API DTOs changed
security-reviewer: N/A — no orbit-api code changed
Validation
Lint: N/A — no source files changed
Type check: N/A — no source files changed
Tests: N/A — no source files changed
Build (api): N/A — no source files changed
What is good
- Consistent with the existing ignore pattern: expo, expo-, @expo/, react-native, react-native-*, babel-preset-expo, and jest-expo are all already ignored for the same lockstep reason. Adding react and react-dom follows the established convention precisely.
- The PR body clearly explains the root cause and the coordinated-upgrade strategy, making the intent traceable for future reviewers.
- The fix is surgical — exactly the two entries needed, nothing more.
Recommendation
No blocking issues. Approve and merge.
|
1 participant
Why
The production-minor-patch group (#261) bumped react-dom → 19.2.7 but left react at 19.2.0. React requires them to be the exact same version, so all 138 web component test files failed with "Incompatible React versions".
Fix
Add
reactandreact-domto the npm Dependabot ignore list — they must move together via a coordinated upgrade (same treatment as the Expo SDK packages). Prevents the standalone-bump mismatch from recurring; the group re-proposes without them.🤖 Generated with Claude Code