mirror of
https://github.com/twentyhq/twenty.git
synced 2026-08-02 18:54:43 -04:00
fb85d29d64
## What Sets `open-pull-requests-limit: 0` on all three npm entries in `.github/dependabot.yml`, disabling routine version-update PRs. ## Why Dependabot's `open-pull-requests-limit` is a *concurrent* cap, not a weekly throughput cap. With a large dependency backlog, every time a PR is closed or merged Dependabot backfills the freed slot with the next outdated dependency — producing an endless trickle of individual PRs rather than the intended "few per week". Setting the limit to `0` stops version-update PRs entirely. ## Impact - **Routine version-bump PRs:** disabled across root + public/internal apps. - **Security advisory updates:** unaffected — these are a separate Dependabot channel not governed by this limit, so vulnerability patches still open automatically. The existing `groups:` config on the apps entries is now inert but left in place, so version updates can be re-enabled later by simply raising the limit. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/22119?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
49 lines
1.6 KiB
YAML
49 lines
1.6 KiB
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
exclude-paths:
|
|
- "packages/twenty-apps/**"
|
|
schedule:
|
|
interval: "weekly"
|
|
# Version-update PRs disabled (limit 0). Security advisory updates are a
|
|
# separate channel and still open automatically — only routine version
|
|
# bumps are turned off to stop the constant PR churn.
|
|
open-pull-requests-limit: 0
|
|
versioning-strategy: "lockfile-only"
|
|
assignees:
|
|
- "mabdullahabaid"
|
|
ignore:
|
|
- dependency-name: "@graphql-yoga/nestjs"
|
|
- dependency-name: "@nestjs/graphql"
|
|
- dependency-name: "@ptc-org/nestjs-query-graphql"
|
|
- dependency-name: "typeorm"
|
|
# chokidar is pinned to v3 via a resolution: v4+ dropped native macOS
|
|
# FSEvents and hits EMFILE on a repo this size (see #20316)
|
|
- dependency-name: "chokidar"
|
|
# Public Twenty apps are standalone packages (own lockfiles) excluded from the
|
|
# root entry above. Each app folder is updated weekly, grouped into a single PR.
|
|
- package-ecosystem: "npm"
|
|
directories:
|
|
- "/packages/twenty-apps/public/*"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 0
|
|
versioning-strategy: "lockfile-only"
|
|
groups:
|
|
twenty-apps-public:
|
|
patterns:
|
|
- "*"
|
|
# Internal Twenty apps, same treatment as the public apps above.
|
|
- package-ecosystem: "npm"
|
|
directories:
|
|
- "/packages/twenty-apps/internal/*"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 0
|
|
versioning-strategy: "lockfile-only"
|
|
groups:
|
|
twenty-apps-internal:
|
|
patterns:
|
|
- "*"
|