Aman-Mittal opened a new issue, #558: URL: https://github.com/apache/fineract-backoffice-ui/issues/558
## Problem `.github/dependabot.yml` configures the `npm` and `github-actions` ecosystems with no `groups`, so Dependabot opens one PR per package. Several of our dependency families peer-depend on each other by exact version, so those PRs are uninstallable on their own and accumulate unmerged. ## Evidence Each open Dependabot PR's `package.json` was applied to `apache/main` and resolved with `npm install --package-lock-only` (resolution only — no build or test run), alone and then grouped with its family: | PR | Bump | Alone | Grouped | Blocking peer | | --- | --- | --- | --- | --- | | #542 | `@angular/common` 22.1.0 → 22.1.1 | ERESOLVE | installs | `@angular/[email protected]` peers `@angular/core@"22.1.1"`, found 22.1.0 | | #522 | `@angular/core` 22.1.0 → 22.1.4 | ERESOLVE | installs | `@angular/[email protected]` peers `@angular/core@"22.1.0"` | | #521 | `@angular/compiler-cli` 22.1.0 → 22.1.4 | ERESOLVE | installs | `@angular/[email protected]` peers `@angular/compiler@"22.1.4"`, found 22.1.0 | | #207 | `@ngx-translate/core` 17 → 18 | installs | installs | — (see note below) | | #516 | `eslint` 9 → 10 | ERESOLVE | **still ERESOLVE** | `[email protected]` peers `eslint "… ^9"` | | #312 | `typescript` 6.0.3 → 7.0.2 | ERESOLVE | **still ERESOLVE** | `@angular/build` peers `typescript ">=6.0 <6.1"` | The grouped Angular run moved every exact-pinned `@angular/*` package to 22.1.4 together and installed cleanly. `#517` and `#518` are a separate shape of the same problem: `.github/workflows/codeql.yml` pins `github/codeql-action/init` and `github/codeql-action/analyze` to one shared SHA, but Dependabot treats the two subpaths as separate dependencies and bumps them with two PRs. Merging one leaves the pair on different versions. ## Two findings worth recording 1. **`typescript` belongs with Angular, not with the linters.** The peer that rejects TypeScript 7 is `@angular/build`'s `typescript >=6.0 <6.1`, not `typescript-eslint`. Any TypeScript bump has to move with the Angular packages. 2. **Grouping is not a fix for an upstream cap.** #516 fails alone and still fails with the entire linting family resolved at its latest versions, because `[email protected]` is the newest published release and caps at `eslint ^9`. #312 is similarly blocked until Angular widens its TypeScript peer range. Both need an `ignore` entry or an upstream release, not a group. ## Proposal Add `groups` to both ecosystems, drawn from the families above: `angular` (including `typescript`), `ionic`, `linting`, `testing`, `ngx-translate`, `types`, and a `catch-all` that batches minor and patch bumps for everything else while leaving majors to arrive individually for review. For `github-actions`, split `codeql` out of the catch-all so the `init`/`analyze` pair moves in one PR. Group order matters, since a dependency joins the first group it matches. Note on `@ngx-translate/*`: #207 does install on its own, because `@ngx-translate/http-loader@17` declares no peer on `@ngx-translate/core`. Grouping it is a judgement call rather than a resolution failure — `http-loader@18` peers `@ngx-translate/core >=18.0.0`, so the pair is real from 18 onward and a lone `core` bump leaves a silent version skew instead of an error. Security updates should stay ungrouped (`applies-to` left at its default of `version-updates`) so they continue to open one focused PR each. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
