ci(gh-actions): group vitest dependabot updates - #2655
Merged
Conversation
vitest and @vitest/* release in lockstep and declare exact peers on each other, so Dependabot raising them as separate PRs produces a version pair that cannot install. #2652 bumped @vitest/coverage-v8 to 5.0.0 on its own and failed every build job with ERESOLVE, because that release requires vitest@5.0.0 exactly. Grouping them means one PR that moves both together.
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The Dependabot grouping is correctly scoped and syntactically valid, and it directly addresses the documented lockstep peer-dependency issue without impacting runtime code.
Pull request overview
Configures Dependabot to group vitest and @vitest/* npm dependency updates into a single PR to avoid peer-dependency resolution failures caused by lockstep versioning (notably @vitest/coverage-v8 requiring an exact matching vitest version).
Changes:
- Adds a Dependabot
groups.vitestrule for thenpmecosystem. - Groups
vitestand@vitest/*patterns so related updates land together.
File summaries
| File | Description |
|---|---|
| .github/dependabot.yml | Adds an npm Dependabot group to combine vitest + @vitest/* updates into one PR to prevent split update install failures. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
rsdmike
approved these changes
Sep 8, 2026
This was referenced Sep 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an npm
groupsentry so Dependabot raisesvitestand@vitest/*as a single PR.Why
@vitest/coverage-v8declares an exact peer on the matchingvitestversion. When Dependabot bumps them separately, the resulting pair cannot install:That is exactly what happened in #2652 — one PR bumping only the coverage package, failing all four build checks. #2654 fixes the current bump by hand; this change stops it recurring.
The
github-actionsecosystem already uses this pattern forcodeql-action, for the same lockstep reason.Note
Grouping only affects future Dependabot PRs; it does not retroactively combine existing ones.