Repository navigation
Configure Dependabot and relax exact pnpm overrides - #2442
Open
mbiernacik wants to merge 2 commits into
Open
mbiernacik wants to merge 2 commits into
mbiernacik wants to merge 2 commits into
Conversation
rafal-hawrylak
approved these changes
Nov 13, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Since the move to pnpm, every Dependabot security update job fails with
security_update_not_possibleand Dependabot hasn't opened a PR. With pnpm, Dependabot can only update direct dependencies, and all current alerts are for transitive ones. Those are fixed by hand withpnpm.overrides, but several overrides pin exact versions, so even compatible patch releases need an edit of the override.Changes
packageManager: pnpm@9.7.1inpackage.json, the version Bazel uses. Without it, Dependabot guesses pnpm 10..github/dependabot.yml: security updates only (open-pull-requests-limit: 0disables version updates), grouped into a single PR.pnpm.overrideswhere the pinned version is within the range requested by every package that depends on it:fast-uri,mdurl,@eslint-community/eslint-utils,@eslint/plugin-kit. Overrides that intentionally force a version outside the requested range (e.g.brace-expansion,serialize-javascript,uuid) are unchanged. Resolved versions don't change; only theoverridessection ofpnpm-lock.yamldoes.contributing.md: new package versions reach the CI registry with a delay, so add or update dependencies with that registry if you have access; how to update transitive dependencies with overrides, and when to use a range or an exact version.