Dependency Review

Scanned Files

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the project's dependency management by configuring Dependabot to group major version updates for all ecosystems. This change addresses issues where interdependent major bumps would generate separate, conflicting pull requests, leading to broken CI. By consolidating these updates, the process for managing significant dependency upgrades will be streamlined and more robust. Additionally, it standardizes the "minor-and-patch" grouping across all Docker configurations.

Highlights

• Dependabot Configuration: Added a "major" update-type group to all eight Dependabot ecosystem configurations (uv, github-actions, pre-commit, npm x2, docker x3).
• Dependency Grouping: Ensured interdependent major dependency bumps are now grouped into a single pull request, preventing separate, conflicting PRs.
• Configuration Consistency: Included the "minor-and-patch" grouping for consistency in the three Docker configurations where it was previously missing.

No actionable comments were generated in the recent review. 🎉

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-14T11:20:53.699Z
Learning: Applies to .github/dependabot.yml : Dependabot auto-updates Docker image digests and versions daily

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-14T11:20:53.699Z
Learning: Applies to .github/workflows/dependency-review.yml : Dependency review: license allow-list (permissive only), PR comment summaries

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-14T11:20:53.699Z
Learning: Applies to .github/workflows/ci.yml : CI jobs run in parallel: lint (ruff) + type-check (mypy) + test (pytest + coverage) + python-audit (pip-audit) + dockerfile-lint (hadolint) + dashboard-lint/type-check/test/build/audit (npm) → ci-pass gate

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-14T11:20:53.699Z
Learning: Applies to .pre-commit-config.yaml : Pre-commit autoupdate disabled (autoupdate_schedule: never) — Dependabot owns hook version bumps via pre-commit ecosystem

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-14T11:20:53.699Z
Learning: Applies to .github/dependabot.yml : Dependabot auto-updates Docker image digests and versions daily

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-14T11:20:53.699Z
Learning: Applies to .pre-commit-config.yaml : Pre-commit autoupdate disabled (autoupdate_schedule: never) — Dependabot owns hook version bumps via pre-commit ecosystem

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-14T11:20:53.699Z
Learning: Commit messages must follow format: <type>: <description> — types are feat, fix, refactor, docs, test, chore, perf, ci — enforced by commitizen

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Greptile Summary

This PR updates .github/dependabot.yml to group major version bumps together (per ecosystem) so that interdependent major upgrades — like echarts 5→6 and vue-echarts 7→8 — land in a single PR instead of separate, conflicting ones. It also backfills the missing minor-and-patch group to the three Docker ecosystem configs for consistency with the other five.

Key changes:

• Adds major: update-types: [major] group to all 8 ecosystem blocks (uv, github-actions, pre-commit, npm ×2, docker ×3)
• Adds minor-and-patch + major groups to the three previously ungrouped Docker entries (/docker/backend, /docker/web, /docker/sandbox)
• The YAML is valid and the grouping logic is sound; every update type (minor, patch, major) is now covered by a named group across all ecosystems
• Existing open individual major PRs (chore: bump echarts from 5.6.0 to 6.0.0 in /web #380, chore: bump vue-echarts from 7.0.3 to 8.0.1 in /web #384) will need to be closed manually — Dependabot will recreate them as grouped PRs on the next run, as acknowledged in the test plan

Confidence Score: 5/5

• This PR is safe to merge — it only modifies Dependabot grouping configuration with no runtime impact.
• The change is limited to a single CI configuration file. The YAML structure is valid, the grouping logic is correct and consistent across all 8 ecosystem entries, and the motivation is well-documented. There are no code changes, no logic paths affected, and the side-effects (existing open individual major PRs needing manual closure) are explicitly acknowledged in the PR.
• No files require special attention.

Important Files Changed

_{Last reviewed commit: ae3d8ba}

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.83%. Comparing base (2db968a) to head (ae3d8ba).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

@@           Coverage Diff           @@
##             main     #388   +/-   ##
=======================================
  Coverage   93.83%   93.83%           
=======================================
  Files         462      462           
  Lines       21653    21653           
  Branches     2079     2079           
=======================================
  Hits        20319    20319           
  Misses       1032     1032           
  Partials      302      302           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.