Add dependabot configuration for automated dependency updates#1405
Add dependabot configuration for automated dependency updates#1405MrgSub merged 1 commit intoMail-0:stagingfrom
Conversation
WalkthroughA new Changes
Assessment against linked issues
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (5)
.github/dependabot.yml (5)
4-8: Consider limiting to direct dependencies
With noallowrules, this will open PRs for every transitive update as well. If you only want to manage your top-levelpackage.json, add anallowfilter or usedependency-type: "direct"to restrict it.
9-14: Separate major from minor/patch updates
Grouping everything under"*"will batch major, minor, and patch together. To avoid large breaking changes slipping through in bulk, consider splitting:groups: major: update-types: ["version-update:semver-major"] patterns: ["*"] minor-and-patch: update-types: ["version-update:semver-minor", "version-update:semver-patch"] patterns: ["*"]
15-37: Refine/apps/mailgrouping for dev tooling
Only React and UI libs are grouped; test frameworks and build tools (e.g.,eslint,jest,typescript) currently fall intoother-dependencies. Consider a separate group for devDependencies so you can review production and tooling updates independently.
45-51: Validate Docker update limits
open-pull-requests-limit: 5is sensible, but double-check it aligns with your team’s cadence. If you miss critical base-image updates, you might need to bump the limit or create a dedicated group.
59-64: Group GitHub Actions updates
Each Action update will open a separate PR by default. To bundle workflow dependency updates, you can add:groups: actions: patterns: - ".github/actions/**"This consolidates them under a single review.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/dependabot.yml(1 hunks)
🔇 Additional comments (3)
.github/dependabot.yml (3)
1-2: Version declaration is correct
The file correctly specifiesversion: 2for Dependabot’s configuration schema.
38-44: Verify grouping strategy for/apps/server
Nogroupsblock is defined here, so each update opens its own PR. If that becomes noisy, you may want to add grouping rules similar to/apps/mail.
52-58: Confirm/docker/dbpath correctness
Ensure that/docker/dbmatches the actual directory where your DB Dockerfiles live—otherwise Dependabot won’t detect those images.
| # Group UI-related packages | ||
| ui-dependencies: | ||
| patterns: | ||
| - "@tiptap*" |
There was a problem hiding this comment.
That’s a good thought! I’d say let’s hold off on Radix for now, it's not as tightly integrated with the others we're grouping. If we notice it becoming a pattern, we can definitely add it later.
2 participants
adds dependabot to the repo
closes #1372
Summary by CodeRabbit