From 3bc8eaa774758133c84ada804e676c7845ce5079 Mon Sep 17 00:00:00 2001 From: janakhpon Date: Wed, 14 Oct 2026 17:53:31 +0700 Subject: [PATCH] ci(deps): split tooling majors out of the group, hold onnxruntime-web - group only minor and patch dev-tooling updates; each major arrives as its own PR - hold onnxruntime-web at 1.24.x: its WebGPU wasm passes Cloudflare's 25 MiB file limit from 1.26.0 - record the 2026-10-14 cause beside both rules --- .github/dependabot.yml | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index a53b037..cc70ebc 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -35,10 +35,14 @@ updates: cooldown: default-days: 7 groups: - # Build and test tooling churns fastest and carries the least risk. + # Build and test tooling churns fastest, but only minor and patch updates are + # grouped. A major bump of one tool breaks the others (2026-10-14: SvelteKit + # 3, vite 8, vitest 5, TypeScript 7 and four more landed as one PR and took + # main red), so majors arrive one per PR, where one failure names one cause. dev-tooling: dependency-type: development patterns: ["*"] + update-types: [minor, patch] # Runtime dependencies, reviewed together but separately from tooling. runtime: dependency-type: production @@ -47,8 +51,15 @@ updates: # onnxruntime-web is pinned to match the graph the model was exported # with. A major bump is a deliberate change that needs the export gates # re-run, not a dependency PR. + # + # Minor bumps are held too, for a second reason: the WebGPU build the app + # loads (ort-wasm-simd-threaded.jsep.wasm) is 23.86 MiB in 1.24.3 and grew + # to 25.02 MiB in 1.26.0 and 27.00 MiB in 1.30.0. Cloudflare Pages rejects + # any file over 25 MiB, so 1.30.0 broke the deploy while every CI job but + # Cloudflare passed. Lift this when a release is back under the limit, or + # the app serves that file from somewhere else. - dependency-name: onnxruntime-web - update-types: [version-update:semver-major] + versions: [">=1.25.0"] - package-ecosystem: gomod directory: /services/feedback