From a93d248b377ffee2d66bd33656e247b2ed4a1f7a Mon Sep 17 00:00:00 2001 From: Sarthak Agrawal Date: Sat, 22 Aug 2026 23:59:20 +0530 Subject: [PATCH] chore(deps): group react updates and pin jscpd Two dependabot rules that failed loudly this week. react: #156 bumped `react` to ^19.2.8 and left `react-dom` at ^19.1.0. That range already admits 19.2.8, so dependabot saw nothing to do, but the lockfile still pinned react-dom@19.2.5 and react-dom asserts at import time that both packages resolve to the same version. Every desktop test died on "Incompatible React versions" before its first assertion, and `@dependabot recreate` reproduced the same split. Grouping them makes it one PR. jscpd: #155 bumped it 5.0.14 -> 5.0.16, and the newer release measured 0.87% duplicated tokens against the fixed `--threshold 0.81` in quality:duplication. The gate failed without a line of source changing. The exact pin was deliberate for that reason, so ignore it here and upgrade it deliberately alongside whatever threshold move it implies. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index bf633cbd..dc150637 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,6 +9,22 @@ updates: patterns: - ccusage - '@ccusage/*' + # react and react-dom assert at runtime that they resolve to the exact + # same version, so they have to move in one PR. Bumping react alone + # leaves react-dom behind in the lockfile and every desktop test dies + # on "Incompatible React versions" before its first assertion. + react-runtime: + patterns: + - react + - react-dom + - '@types/react' + - '@types/react-dom' + ignore: + # jscpd is exact-pinned on purpose. quality:duplication compares its + # measured duplication against a fixed --threshold, so a patch bump that + # simply detects more clones fails the gate without any code changing. + # Upgrade it deliberately, alongside whatever threshold move it implies. + - dependency-name: jscpd labels: - dependencies - ccusage