Migrate Dependabot to Renovate and absorb open dependency PRs - #172
Conversation
Disable Dependabot, consolidate Renovate config, absorb open dep bumps, and fix CI/auto-merge blockers that were failing dependency PRs. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review Summary
This PR successfully migrates dependency management from Dependabot to Renovate and absorbs multiple open dependency PRs. All changes have been reviewed and appear correct.
Key Changes Verified:
- Renovate Configuration: Well-structured configuration with appropriate grouping, automerge rules, and security settings
- CI Improvements: Fixed Codecov token handling to prevent PR failures when token is unavailable; auto-merge now correctly ignores SKIPPED checks
- Dependency Updates: Routine minor/patch version bumps across
@modelcontextprotocol/sdk,js-yaml,@biomejs/biome,@types/node,@vitest/coverage-v8,eslint,knip,prettier,typescript-eslint,vitest, and dependency overrides - GitHub Actions: Bumped
actions/setup-nodefrom v6 to v7 across all workflows
No defects or security issues identified that would block merge. The changes improve CI reliability and consolidate dependency management under Renovate.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
Raise patched overrides beyond the Dependabot target versions and satisfy Biome 2.5.3 unsafe optional-chaining rules in evidence-capture tests. Co-authored-by: Cursor <cursoragent@cursor.com>
Update the schema pin and make doctor gitignore assertions safe under the stricter Biome rule. Co-authored-by: Cursor <cursoragent@cursor.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Summary
.github/dependabot.ymlremoved) and make Renovate the sole dependency updater via consolidated.github/renovate.jsonSKIPPEDchecks as failuresactions/setup-nodefrom v6 to v7 across workflowsTest plan
npm run typechecknpm test(821 tests passed)Supersedes
Closes Dependabot PRs: #141 #143 #146 #147 (TS major deferred) #148 #149 #150 #151 #152 #153 #154 #155 #156 #157 #158 #159 #160 #171