ci(gh-actions): group vitest dependabot updates - #2900
Merged
Conversation
vitest and @vitest/* release in lockstep and declare exact peers on each other, so raising them as separate PRs produces a pair that cannot install. #2894 and #2895 each bumped one half to 5.0.0 and failed every build job with ERESOLVE. Grouping them means one PR that moves both together, matching the existing codeql-action group under github-actions.
rsdmike
approved these changes
Sep 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an npm
groupsentry so Dependabot raisesvitestand@vitest/*as a single PR.Why
@vitest/coverage-v8declares an exact peer on the matchingvitestversion. Split across separate PRs, each side pairs a 5.0.0 package with a 4.x sibling andnpm cifails:That is exactly what happened with #2894 and #2895 — both red on
build,build (22.x),build (24.X),dockerandValidate PR and Commits. #2899 fixes the current bump by hand; this stops it recurring.The
github-actionsecosystem already uses this pattern forcodeql-action, for the same lockstep reason.Scope
Deliberately limited to vitest, matching device-management-toolkit/mps#2655. There is a case for grouping other lockstep pairs (runtime packages with their
@types/*— that split caused a separate failure in mps), but that is left out to keep this reviewable.Note
Grouping only affects future Dependabot PRs; it does not retroactively combine existing ones.