mirror of
https://github.com/software-mansion/argent.git
synced 2026-09-14 19:27:14 +08:00
Ignacy Łątka
02e500884f
## What Applies the safe updates from dependabot #348 (`npm-minor-patch` group) and **excludes the one bump that breaks the build**, `tree-sitter`. | Package | From | To | | --- | --- | --- | | prettier | 3.8.3 | 3.8.4 | | @clack/prompts | 1.1.0 / 1.4.0 | 1.5.1 | | @types/node | 25.9.0 | 25.9.3 | | esbuild | 0.28.0 | 0.28.1 | | semver | 7.7.4 / 7.8.0 | 7.8.4 | | vitest | 4.1.6 | 4.1.9 | | tree-sitter | 0.21.1 | **held at 0.21.1** | (`ws` was part of #348's group but is already at 8.21.0 on `main`, so it's untouched here.) ## Why tree-sitter is excluded `tree-sitter@0.25.0` ships **no Node 24 prebuilds**, and its `binding.gyp` forces `-std=c++17` while Node 22+ v8 (cppgc) headers require C++20, so the native build fails `npm ci`/`npm install` on current Node. That's exactly why #348's `ESLint` job (Node 24) fails at install: ``` .../node_modules/tree-sitter ... node-gyp-build .../include/node/v8config.h:13:2: error: #error "C++20 or later required." ``` (#348's `Unit tests` job is pinned to Node 20, where it still compiles — which is why that PR looks half-green.) There is no tree-sitter release between 0.22.4 and 0.25.0, so there's no newer working version. `^0.21.1` ships N-API prebuilds (no compile) and installs cleanly on Node 20 / 22 / 24. This PR also adds a Dependabot `ignore` for tree-sitter minor/major so the group stops re-proposing the broken bump. Patch updates stay allowed; drop the ignore once upstream restores prebuilt binaries. ## Verification (local) - Lockfile regenerated on **Node 20 / npm 10.8.2** (`npm install --package-lock-only --ignore-scripts`), idempotent under a re-run — won't trip the strict lockfile check. tree-sitter resolves to 0.21.1 (prebuilt, no native compile). - Full CI-equivalent on **Node 20**: `tsc --build`, `eslint --max-warnings 0`, `prettier --check`, `typecheck:tests`/`typecheck:scripts`, full unit suite incl. **1250 tool-server tests** — all green. - `npm ci` from the committed lockfile succeeds. - **Live device E2E**: ran the built tool-server with the bumped deps, captured a real screenshot of a booted iPhone 16 Pro Max (`simulator-client` uses `ws`), then downloaded the PNG artifact over HTTP — `200`, 331 KB PNG. Supersedes #348 (Dependabot auto-closes it once the safe bumps land and tree-sitter is ignored).
75 lines
2.1 KiB
YAML
75 lines
2.1 KiB
YAML
# Dependabot configuration
|
|
# Docs: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
|
|
version: 2
|
|
|
|
updates:
|
|
# npm: root + every workspace package (packages/*)
|
|
- package-ecosystem: "npm"
|
|
directories:
|
|
- "/"
|
|
- "/packages/*"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
time: "06:00"
|
|
timezone: "Etc/UTC"
|
|
open-pull-requests-limit: 10
|
|
labels:
|
|
- "dependencies"
|
|
- "npm"
|
|
commit-message:
|
|
prefix: "chore(deps)"
|
|
prefix-development: "chore(deps-dev)"
|
|
include: "scope"
|
|
ignore:
|
|
# tree-sitter 0.25.0 ships no Node 24 prebuilds and its binding.gyp forces
|
|
# C++17 while Node 22+ v8 (cppgc) headers require C++20, so the native
|
|
# build fails `npm install`/`npm ci` on current Node. Stay on ^0.21.1,
|
|
# which ships N-API prebuilds (no compile). Patch updates stay allowed;
|
|
# drop this ignore once upstream restores prebuilt binaries.
|
|
- dependency-name: "tree-sitter"
|
|
update-types:
|
|
- "version-update:semver-minor"
|
|
- "version-update:semver-major"
|
|
groups:
|
|
# Batch all minor + patch updates into one PR per week to cut noise.
|
|
npm-minor-patch:
|
|
applies-to: version-updates
|
|
patterns:
|
|
- "*"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
# Keep majors grouped but separate, since they typically need human review.
|
|
npm-major:
|
|
applies-to: version-updates
|
|
patterns:
|
|
- "*"
|
|
update-types:
|
|
- "major"
|
|
# Group security updates across all directories.
|
|
npm-security:
|
|
applies-to: security-updates
|
|
patterns:
|
|
- "*"
|
|
|
|
# GitHub Actions used by workflows under .github/workflows
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
time: "06:00"
|
|
timezone: "Etc/UTC"
|
|
open-pull-requests-limit: 5
|
|
labels:
|
|
- "dependencies"
|
|
- "github-actions"
|
|
commit-message:
|
|
prefix: "chore(ci)"
|
|
include: "scope"
|
|
groups:
|
|
github-actions:
|
|
patterns:
|
|
- "*"
|