chore(deps): ignore TypeScript and @types/node major updates in Dependabot by nilhemdot · Pull Request #23 · nilhemdot/agent-os

nilhemdot · 2026-10-04T02:36:13Z

Summary

Stops Dependabot from opening major-version PRs for typescript and @types/node. #18 and #21 were closed by hand because closing a PR only skips that exact version. Minor and patch updates for both packages, including security fixes, still arrive as normal.

Changes

.github/dependabot.yml: adds ignore rules with update-types: ['version-update:semver-major'] for:
- typescript: typescript-eslint supports typescript <6.1, and 7.x is the new native compiler, so a major bump breaks lint. This also skips TypeScript 6. Upgrade by hand once typescript-eslint supports it.
- @types/node: keeps the Node type definitions on the Node 22 line that .nvmrc and CI use.

Testing

dependabot.yml parses and the ignore entries are in the npm update block
npm run typecheck / lint / test / eval / build: not applicable (config-only change)

Security checklist

No direct child_process imports in src/app/** or src/features/**
No secrets, API keys, .env files or personal config committed
No new dependencies

🤖 Generated with Claude Code

https://claude.ai/code/session_01KddPyDgHXVotgYiCUfYS3e

Generated by Claude Code

Summary by CodeRabbit

Chores
- Automated update proposals for selected development tools will continue to include minor and patch releases, while major-version updates will be held back. This changes which updates are proposed automatically; it does not change app features or behavior.

Confidence Score: 5/5

The PR appears safe to merge.

Summary

Adds Dependabot ignore rules for major updates to typescript and @types/node, while leaving minor and patch updates eligible.

_{Reviews (1) · Last reviewed commit: "chore(deps): ignore TypeScript and @type..."}

…dabot - typescript: typescript-eslint supports typescript <6.1 and 7.x is the new native compiler, so a major bump breaks lint (#18). - @types/node: keep typings on the Node 22 runtime line used by .nvmrc and CI (#21). Minor and patch updates for both still arrive as normal. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KddPyDgHXVotgYiCUfYS3e

vercel · 2026-10-04T02:36:14Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
agent-os	Ready	Preview	Oct 4, 2026 2:36am UTC

ecc-tools · 2026-10-04T02:36:18Z

ECC Tools / Security Evidence

Commit: 0538552e7d94bc8e211ea9bb3ff3c3b30bef7f1e

Security scanner evidence required (action_required)

Detected 1 security-sensitive predictive risk signal(s) without scanner evidence.

Mode: enforce

Findings:

Security-sensitive changes may ship without scanner evidence: The PR touches billing, secrets, auth, webhooks, agent, or CI-sensitive surfaces without adding obvious security scanner, code scanning, or security-focused validation evidence. (1 security-sensitive paths changed; 0 security scanner or security-focused validation artifacts changed)

Touched security-sensitive paths:

.github/dependabot.yml

Expected evidence:

Security scanner, code scanning, secret scanning, dependency/security review, or focused security regression output.
SARIF/code-scanning upload or equivalent pass/fail gate for the changed surface.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

ecc-tools · 2026-10-04T02:36:19Z

ECC Tools / PR Risk Taxonomy

Commit: 0538552e7d94bc8e211ea9bb3ff3c3b30bef7f1e

PR taxonomy review recommended (neutral)

Detected 1 PR taxonomy bucket(s): Security Evidence.

Scanned 1 changed file(s).

Roadmap taxonomy buckets:

Security Evidence

Security-sensitive changes should carry explicit scanner, code-scanning, or focused regression evidence.

Signals:

Security-sensitive changes may ship without scanner evidence
0 security-sensitive path(s) changed

Paths:

.github/dependabot.yml

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

ecc-tools · 2026-10-04T02:36:20Z

ECC Tools / Reference Set Readiness

Commit: 0538552e7d94bc8e211ea9bb3ff3c3b30bef7f1e

Reference set readiness gaps detected (neutral)

Reference evidence present for 0/7 areas (0%) across 1 changed file(s).

This check is based on files changed in this PR. Repository-level readiness is still reported by /ecc-tools analyze comments and generated manifests.

Area	Status	Evidence / Next Step
Deep analyzer corpus	Missing	Add analyzer fixture, golden, benchmark, or reference-set files that can catch analyzer regressions.
RAG/evaluator comparison	Missing	Add retrieval or evaluator reference-set comparison fixtures with expected ranking behavior.
PR salvage/review corpus	Missing	Add stale-PR, review-thread, reopen-flow, or salvage reference cases for queue cleanup automation.
Discussion triage corpus	Missing	Add public discussion triage fixtures, golden cases, or reference sets for informational, answered, and no-response classifications.
Harness compatibility	Missing	Add cross-harness, adapter-compliance, or harness-audit evidence for Claude, Codex, OpenCode, Zed, dmux, and agent surfaces.
Security evidence	Missing	Attach security evidence such as SBOMs, SARIF, audit reports, or AgentShield evidence packs.
CI failure-mode evidence	Missing	Add captured CI failure logs, dry-run fixtures, or troubleshooting docs for common workflow failure modes.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

coderabbitai · 2026-10-04T02:36:21Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository UI
Review profile: CHILL
Plan: Advanced
Run ID: b4969666-a9f6-4278-a00f-a700d72fa77a

📥 Commits

Reviewing files that changed from the base of the PR and between d09435e and 0538552.

📒 Files selected for processing (1)

.github/dependabot.yml

 ________________________________________________________________
< Paging Dr. CodeRabbit. Dr. CodeRabbit to the code review room. >
 ----------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

ecc-tools · 2026-10-04T02:36:22Z

ECC Tools / Hosted Promotion Readiness

Commit: 0538552e7d94bc8e211ea9bb3ff3c3b30bef7f1e

Hosted promotion readiness passed (success)

No hosted promotion evidence gaps detected across 1 changed file(s); 0 corpus scenarios had matching evidence.

This check compares PR file changes against the evaluator/RAG promotion corpus in src/analyzers/fixtures/evaluator-rag-corpus.ts.
Hosted output scoring inspected 0 completed cached hosted job results.

No evaluator corpus scenarios matched this PR.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

chatgpt-codex-connector · 2026-10-04T02:36:46Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

nilhemdot · 2026-10-04T02:38:28Z

Test (windows-latest) fails in Run tests. This is the known Windows-only failure that also happens on main (backlog M8-6), and it isn't a required check. This PR only changes dependabot.yml. All required checks pass.

Generated by Claude Code

graphify-labs

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

Graphify review — findings

Stops Dependabot from opening major-version bumps for typescript and @types/node, while still letting their minor and patch updates through. TypeScript majors wait on typescript-eslint support, which stops below 6.1, and 7.x moves to the native Go compiler. Node typings stay on the Node 22 runtime line used by .nvmrc and CI.

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 0 functions depend on the 0 functions this change touches.

Health — grade A; no new coupling hotspots.

Verification — 0 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

kilo-code-bot · 2026-10-04T02:41:02Z

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 file)

.github/dependabot.yml - 0 issues

_{Reviewed by free · Input: 132.7K · Output: 3.7K · Cached: 92.1K}

vercel Bot deployed to Preview October 4, 2026 02:36 View deployment

nilhemdot marked this pull request as ready for review October 4, 2026 02:36

nilhemdot merged commit 772f7b4 into main Oct 4, 2026
15 of 18 checks passed

graphify-labs Bot reviewed Oct 4, 2026

View reviewed changes

nilhemdot deleted the claude/dependabot-ignore-majors branch October 8, 2026 23:57

Navigation Menu

Repository navigation

chore(deps): ignore TypeScript and @types/node major updates in Dependabot - #23

chore(deps): ignore TypeScript and @types/node major updates in Dependabot#23
nilhemdot merged 1 commit into
mainfrom
claude/dependabot-ignore-majors

nilhemdot commented Oct 4, 2026 •

edited by greptile-apps Bot

Loading

Uh oh!

vercel Bot commented Oct 4, 2026 •

edited

Loading

Uh oh!

ecc-tools Bot commented Oct 4, 2026

Uh oh!

ecc-tools Bot commented Oct 4, 2026

Uh oh!

ecc-tools Bot commented Oct 4, 2026

Uh oh!

coderabbitai Bot commented Oct 4, 2026 •

edited

Loading

Uh oh!

ecc-tools Bot commented Oct 4, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 4, 2026

Uh oh!

nilhemdot commented Oct 4, 2026

Uh oh!

Uh oh!

graphify-labs Bot left a comment

Uh oh!

kilo-code-bot Bot commented Oct 4, 2026 •

edited

Loading

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

nilhemdot commented Oct 4, 2026 • edited by greptile-apps Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Testing

Security checklist

Summary by CodeRabbit

Confidence Score: 5/5

Uh oh!

vercel Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ecc-tools Bot commented Oct 4, 2026

ECC Tools / Security Evidence

Uh oh!

ecc-tools Bot commented Oct 4, 2026

ECC Tools / PR Risk Taxonomy

Security Evidence

Uh oh!

ecc-tools Bot commented Oct 4, 2026

ECC Tools / Reference Set Readiness

Uh oh!

coderabbitai Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ecc-tools Bot commented Oct 4, 2026

ECC Tools / Hosted Promotion Readiness

Uh oh!

chatgpt-codex-connector Bot commented Oct 4, 2026

Uh oh!

nilhemdot commented Oct 4, 2026

Uh oh!

Uh oh!

graphify-labs Bot left a comment

Choose a reason for hiding this comment

Graphify review — findings

Impact & health

Graphify review

Gate & verification

graphify gate

Uh oh!

kilo-code-bot Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

nilhemdot commented Oct 4, 2026 •

edited by greptile-apps Bot

Loading

vercel Bot commented Oct 4, 2026 •

edited

Loading

coderabbitai Bot commented Oct 4, 2026 •

edited

Loading

kilo-code-bot Bot commented Oct 4, 2026 •

edited

Loading