Aman-Mittal opened a new pull request, #559: URL: https://github.com/apache/fineract-backoffice-ui/pull/559
## What and why `.github/dependabot.yml` had no `groups`, so Dependabot opened one PR per package. The pinned `@angular/*` packages peer-depend on each other by exact version, so those PRs are uninstallable alone and sit unmerged. This adds groups to both ecosystems, drawn from the families that actually fail to resolve individually rather than from a guess at what looks related. Closes #558 ## Verification Each open Dependabot PR's `package.json` was applied to `apache/main` and resolved with `npm install --package-lock-only` (resolution only — no build or test run), alone and then grouped with its family: | PR | Bump | Alone | Grouped | Blocking peer | | --- | --- | --- | --- | --- | | #542 | `@angular/common` 22.1.0 → 22.1.1 | ERESOLVE | installs | `@angular/[email protected]` peers `@angular/core@"22.1.1"`, found 22.1.0 | | #522 | `@angular/core` 22.1.0 → 22.1.4 | ERESOLVE | installs | `@angular/[email protected]` peers `@angular/core@"22.1.0"` | | #521 | `@angular/compiler-cli` 22.1.0 → 22.1.4 | ERESOLVE | installs | `@angular/[email protected]` peers `@angular/compiler@"22.1.4"`, found 22.1.0 | | #207 | `@ngx-translate/core` 17 → 18 | installs | installs | — | | #516 | `eslint` 9 → 10 | ERESOLVE | **still ERESOLVE** | `[email protected]` peers `eslint "… ^9"` | | #312 | `typescript` 6.0.3 → 7.0.2 | ERESOLVE | **still ERESOLVE** | `@angular/build` peers `typescript ">=6.0 <6.1"` | The grouped Angular run moved every exact-pinned `@angular/*` package to 22.1.4 together and installed cleanly. A baseline run of unmodified `apache/main` installs, confirming the failures above come from the bumps and not the harness. Group membership was then checked by replaying Dependabot's first-match-wins glob matching over all 39 entries in `package.json` and over every `uses:` in `.github/workflows/` — nothing falls through ungrouped, and `codeql` claims both codeql-action subpaths before the catch-all sees them. `npx prettier --check .github/dependabot.yml` passes. ## Screenshots Not applicable — CI configuration only. ## Two things the evidence changed 1. **`typescript` is grouped with Angular, not with the linters.** The peer that rejects TypeScript 7 in #312 is `@angular/build`'s `typescript >=6.0 <6.1`, not `typescript-eslint`, so a TypeScript bump has to move with the Angular packages. 2. **Grouping cannot fix #516 or #312, and the config comments say so.** #516 fails alone and still fails with the entire linting family resolved at latest, because `[email protected]` is the newest published release and caps at `eslint ^9`. Both PRs are blocked on upstream releases, not on how Dependabot batches them. If the weekly noise is unwanted in the meantime, `ignore` entries are the tool — happy to add them here or in a follow-up, scoped so they lift when the caps do. `@ngx-translate/*` is the one group not backed by a resolution failure, and it is commented as such in the file: #207 installs alone because `http-loader@17` declares no peer on `core`. It is grouped because `http-loader@18` peers `@ngx-translate/core >=18.0.0`, so a lone `core` bump produces a silent version skew rather than an error. Straightforward to drop if the preference is to keep the config strictly ERESOLVE-driven. `applies-to` is left at its default of `version-updates`, so security updates continue to open one focused PR each instead of waiting for a weekly group. ## AI assistance (optional) - Tool / model: Claude Opus 5, via Claude Code. - Harness / workflow: assisted investigation and drafting. The resolution results in the table above were produced by running `npm install --package-lock-only` locally against each PR's manifest; the group membership check was a local script replaying Dependabot's glob matching. ## Checklist - [x] I did not hand-edit generated files under `src/app/api/`. - [x] New component or service code uses the adapter boundary in `src/app/core/adapters/` instead of direct browser globals or imperative third-party APIs. — Not applicable; no application code changed. - [x] User-facing strings use translation keys. — Not applicable; no user-facing strings. - [x] I added or updated tests appropriate to this change, or explained why tests were not needed. — `.github/dependabot.yml` is consumed by GitHub, not by this repo's test runners, so there is nothing to assert against in CI. It was verified out of band as described under Verification. - [x] UI workflow changes include suitable e2e coverage, including real-backend testing where relevant. — Not applicable; no UI change. - [x] Commits are signed — see [Commit Signing](CONTRIBUTING.md#commit-signing) in CONTRIBUTING.md. - [x] I followed the [AI-assisted contributions guidance](CONTRIBUTING.md#ai-assisted-contributions). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
