From f5a31bc47bcbd2ae8c85fb334e18f98ac0c96172 Mon Sep 17 00:00:00 2001 From: Jesse Katsumata Date: Sun, 15 Nov 2026 14:04:38 +0900 Subject: [PATCH] chore: group the React Native family in dependabot `@react-native/*` and `@react-native-community/cli` track the react-native minor line, and `@types/react` tracks `react`. Dependabot was proposing each of them as its own PR, which produces version combinations nobody ships -- the open PRs bumping @react-native/metro-config to 0.88.1 while react-native stays on ^0.81.1 are exactly that. Group them so they are offered as a single coordinated PR instead. Grouping rather than ignoring keeps the updates visible; ignoring would have made them invisible and fully manual. `exclude-patterns` is deliberate, not redundant. GitHub's reference documents `*` as the wildcard but never states how a pattern without one is matched -- exact name or substring. Under a substring reading, bare `react` would also capture react-native-builder-bob, react-native-test-app, @rnx-kit/metro-config, @types/react-native and @callstack/react-native-visionos, grouping packages that do move independently. Excludes take precedence over patterns, so naming them makes the config behave identically under either reading. Verified every devDependency lands where intended: the six family members are matched, and biome, release-it, @release-it/conventional-changelog, jest, @types/jest, pod-install and typescript continue to get individual PRs. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 4872c5af..a133c835 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,3 +5,31 @@ updates: schedule: interval: daily open-pull-requests-limit: 10 + # The React Native family is version-locked: `@react-native/*` and + # `@react-native-community/cli` track the react-native minor line, and + # `@types/react` tracks `react`. Bumping any of them on its own produces a + # combination nobody ships, so dependabot proposes them as one PR that moves + # them together. Anything not matched here still gets its own PR. + # + # `exclude-patterns` is not redundant. GitHub's reference documents `*` as the + # wildcard but does not say how a pattern *without* one is matched -- exact + # name or substring. If it is a substring match, bare `react` would also + # capture react-native-builder-bob, react-native-test-app and the rest below, + # grouping packages that genuinely do move independently. Excludes take + # precedence over patterns, so naming them keeps this config correct under + # either reading. @rnx-kit/metro-config in particular was bumped on its own + # in #1242 with CI clean, so it is not part of this family. + groups: + react-native: + patterns: + - react + - react-native + - "@react-native/*" + - "@react-native-community/cli" + - "@types/react" + exclude-patterns: + - react-native-builder-bob + - react-native-test-app + - "@rnx-kit/*" + - "@types/react-native" + - "@callstack/react-native-visionos"