Files
OwnCord/.github/dependabot.yml
T
J3vbandClaude Opus 5 0ccb42932c build(deps): pin rfd to tauri-plugin-dialog's major to unblock the cargo group (#1406)
The cargo-dependencies group PR (#1405) fails Rust Unit Tests on Linux:

    error: failed to run custom build command for `rfd v0.17.2`
    You need to choose at least one backend: `gtk3` or `xdg-portal`
    features for x86_64-linux

rfd is not really ours. It arrives in the tree via tauri-plugin-dialog,
which pins ^0.16; we declare it directly only for the fatal-startup
message box in lib.rs, where the Tauri app never finished building and
the plugin has no AppHandle to run a dialog through.

Cargo unifies features only within a semver-compatible version group, so
while both wanted ^0.16 there was a single rfd in the graph and the
plugin's backend features covered our `default-features = false`
declaration too. Bumping our direct dep to 0.17 forks rfd into two
crates: the plugin keeps 0.16.0 with its features, ours resolves to
0.17.2 with none, and rfd 0.17 added a build.rs assertion that aborts
the Linux build when no backend feature is set. Confirmed in the PR's
lockfile, which carries both 0.16.0 and 0.17.2.

Adding a Linux backend feature would be the wrong fix: it would paper
over the fork and still build rfd twice on every platform for one error
dialog. Our version has to track the plugin's instead, so ignore
semver-minor rfd updates (0.16 -> 0.17 for a 0.x crate) until
tauri-plugin-dialog moves. Patch updates inside 0.16.x still flow.

The remaining five crates in the group are unaffected; `windows` in fact
consolidates 3 versions down to 2.

Cargo.toml is comment-only here - no dependency, feature, or lockfile
change - so the build is untouched.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-25 19:49:37 +02:00

110 lines
3.4 KiB
YAML

version: 2
# Every ecosystem groups its updates into a single PR. Splitting per package
# means each ecosystem's lockfile (go.sum, package-lock.json, Cargo.lock) is
# rewritten once per PR, so merging any one of them invalidates all the rest —
# every sibling then rebases and re-runs the full ~15 minute CI matrix. The
# 2026-08-10 batch opened 17 PRs for one weekly refresh.
#
# Grouping also keeps release trains together. The OpenTelemetry modules move
# in lockstep, and npm families version-lock their own packages with exact peer
# pins (typescript-checker@9.6.0 requires core@9.6.0, not ^9.6.0), so a partial
# merge is an ERESOLVE failure waiting to happen.
#
# Majors are ignored everywhere below, so each group only ever carries patch and
# minor updates. If one member of a group is bad, add it to that ecosystem's
# ignore list rather than ungrouping the rest.
updates:
# Go server dependencies
- package-ecosystem: gomod
directory: /Server
schedule:
interval: weekly
day: monday
commit-message:
prefix: "chore(deps):"
labels:
- dependencies
- go
open-pull-requests-limit: 10
groups:
go-dependencies:
patterns:
- "*"
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major"]
# Tauri client npm dependencies
- package-ecosystem: npm
directory: /Client/tauri-client
schedule:
interval: weekly
day: monday
commit-message:
prefix: "chore(deps):"
labels:
- dependencies
- npm
open-pull-requests-limit: 10
groups:
npm-dependencies:
patterns:
- "*"
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major"]
# Tauri Rust/Cargo dependencies
- package-ecosystem: cargo
directory: /Client/tauri-client/src-tauri
schedule:
interval: weekly
day: monday
commit-message:
prefix: "chore(deps):"
labels:
- dependencies
- rust
open-pull-requests-limit: 5
groups:
cargo-dependencies:
patterns:
- "*"
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major"]
# rfd rides into the tree on tauri-plugin-dialog, which pins ^0.16, and we
# declare it directly only for the fatal-startup dialog in lib.rs (there is
# no AppHandle yet, so the plugin API is unusable at that point). Cargo
# unifies features only within a semver-compatible group, so bumping our
# direct dep to 0.17 forks rfd in two: the plugin keeps 0.16 with its
# backend features, ours gets 0.17 with none, and rfd 0.17's build.rs then
# aborts the Linux build demanding `gtk3` or `xdg-portal` (PR #1405). Even
# where it links, it just builds rfd twice. Our version must track the
# plugin's -- drop this entry once tauri-plugin-dialog moves to 0.17.
# Patch updates within 0.16.x still flow through.
- dependency-name: "rfd"
update-types: ["version-update:semver-minor"]
# GitHub Actions
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
day: monday
commit-message:
prefix: "ci(deps):"
labels:
- dependencies
- ci
open-pull-requests-limit: 5
groups:
actions-dependencies:
patterns:
- "*"
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major"]