Fix failing Dependabot PRs: CodeQL version lockstep, Babel 8 block, undici bundle - #369
Open
Alexandre Zollinger Chohfi (azchohfi) wants to merge 1 commit into
Open
Alexandre Zollinger Chohfi (azchohfi) wants to merge 1 commit into
Alexandre Zollinger Chohfi (azchohfi) wants to merge 1 commit into
Conversation
Alexandre Zollinger Chohfi (azchohfi)
force-pushed
the
azchohfi-fix-dependabot-ci-failures
branch
2 times, most recently
from
September 2, 2026 22:35
7d3d84d to
f9980e1
Compare
Alexandre Zollinger Chohfi (azchohfi)
marked this pull request as ready for review
September 2, 2026 22:38
Alexandre Zollinger Chohfi (azchohfi)
enabled auto-merge
September 9, 2026 03:12
Supersedes the six failing open Dependabot PRs, which fail for three distinct reasons. CodeQL (#376, #377, #378): Dependabot treats codeql-action/init, /autobuild and /analyze as three separate dependencies and opens one PR per action. All three must run the same version, so each PR fails with "Loaded a configuration file for version '4.37.8', but running version '4.38.0'". Bump all three to v4.38.0 together. Babel (#373, #375): @babel/core and @babel/preset-env are peer-linked, so bumping either alone fails with ERESOLVE. Bumping both together still fails, because ts-jest 29.4.12 (latest) declares peerOptional @babel/core ">=7.0.0-beta.0 <8". Babel 8 is therefore not adoptable yet, so ignore the major bump until ts-jest supports it. undici (#359): undici is bundled into the committed dist/index.js, so the lock bump also requires rebuilding dist. Also group codeql-action and babel in dependabot.yml so future bumps land as a single PR instead of splitting into individually-broken ones. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Alexandre Zollinger Chohfi (azchohfi)
force-pushed
the
azchohfi-fix-dependabot-ci-failures
branch
from
September 16, 2026 22:06
f9980e1 to
cf1203a
Compare
Alexandre Zollinger Chohfi (azchohfi)
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #359, #373, #375, #376, #377, #378.
All six open Dependabot PRs are red. They fail for three unrelated reasons, each caused by Dependabot splitting up changes that only work together.
Rebased onto latest
main, and refreshed for the newest Dependabot rounds: CodeQL has since moved 4.37.9 → 4.38.0, and Babel 8.0.1/8.0.2 → 8.0.5. The root causes are unchanged — only the version numbers moved.1. CodeQL — #376, #377, #378 (
Analyze (TypeScript)fails)Dependabot treats
github/codeql-action/init,/autobuildand/analyzeas three independent dependencies, so it opens one PR per action. But all three must run the same version. Each PR bumps only one, leaving the other two at 4.37.8, and the run aborts:Nothing is actually wrong with the autobuild step itself — it's purely version skew.
Fix: bump all three to
v4.38.0(b96794f) in one commit.2. Babel — #373, #375 (
build,check-distfail)@babel/coreand@babel/preset-envare peer-linked, so bumping either alone failsnpm ciwithERESOLVE. But bumping both together still fails, because the latestts-jest(29.4.12) declares:Still no
ts-jestrelease supports Babel 8 (re-checked against the registry for this update), so Babel 8 is not adoptable in this repo yet — these two PRs are simply not mergeable today.Fix: stay on Babel 7 and
ignorethe major bump independabot.yml, with a comment to drop the ignore oncets-jestsupports Babel 8. This also stops Dependabot reopening a fresh, still-unmergeable Babel PR on every 8.x release.3. undici — #359 (
check-distfails)undiciis a transitive runtime dep (via@actions/http-client) that gets bundled into the committeddist/index.js. Dependabot updatespackage-lock.jsonbut never rebuildsdist/, so the bundle no longer matches the lock. (check-distreports "Binary files differ" only because.gitattributessetsdist/** -diff.)Fix: bump the lock and commit the rebuilt bundle. The
dist/diff is +88/−6 lines of undici header-validation hardening (isValidHeaderValue/validatePartialResponseContentLength) — it was built by this repo's owncheck-distworkflow, so it's reproducible by definition.Preventing recurrence
Added
groupsto.github/dependabot.ymlsogithub/codeql-action*and the Babel packages each land as a single PR instead of splitting into individually-broken ones.Worth stressing that #1 would otherwise repeat on every codeql-action release — it's structural, not a one-off. It has already recurred once while this PR was open (4.37.9 → 4.38.0).
Validation
All checks green:
build,check-dist,Analyze (TypeScript),test-linux,test-macos,test-windows.