From 3846e061e9aa177bf761f45943789104609ff92c Mon Sep 17 00:00:00 2001 From: Kieran Osgood Date: Mon, 5 Oct 2026 13:45:49 +0100 Subject: [PATCH] Group Dependabot updates and run them monthly Dependabot opened 67 version-update PRs in the last 90 days, mostly one PR per dependency per directory. Group updates by family and move version updates to a monthly schedule. Security updates are configured separately and are unaffected. Android (32 of the 67 PRs), following the grouping used by Android projects such as element-x-android, bitwarden/android and tivi: - Group AGP, Kotlin + KSP, Apollo, AndroidX and test libraries. The existing apollo group only matched com.apollographql.apollo*, so normalized-cache updates arrived separately. - Share one androidGradlePlugin version ref for com.android.application and com.android.library. AGP needs one version per build, and two refs meant two PRs per AGP release. - Limit the sample entry to the sample build's own Gradle wrapper and settings plugin. The version catalog is shared, so the sample scan duplicated the library entry's PRs. GitHub Actions (17 of the 67): group all actions into one PR and scan the local composite actions in .github/actions, which were not updated before. npm and Bundler: group each entry into one PR. Grouping the React Native sample means one Podfile.lock refresh per cycle for native module updates. --- .github/dependabot.yml | 131 ++++++++++++-------- platforms/android/gradle/libs.versions.toml | 8 +- 2 files changed, 83 insertions(+), 56 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 904bac337..9e160378a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,24 +1,36 @@ version: 2 + +# Version updates run monthly and are grouped so each ecosystem produces a small, +# predictable set of pull requests. Security updates are configured separately and +# are not delayed by this schedule. updates: - package-ecosystem: github-actions - directory: "/" + # Include local composite actions so the actions they use are updated too. + directories: + - "/" + - "/.github/actions/*" schedule: - interval: weekly + interval: monthly cooldown: default-days: 7 + groups: + github-actions: + patterns: + - "*" - package-ecosystem: swift directory: "/" schedule: - interval: weekly + interval: monthly cooldown: default-days: 7 - # Android library + # Android library. The version catalog in platforms/android/gradle is shared with + # the Android sample app, so this entry covers the sample's catalog dependencies too. - package-ecosystem: gradle directory: "/platforms/android" schedule: - interval: weekly + interval: monthly open-pull-requests-limit: 10 cooldown: default-days: 7 @@ -43,48 +55,48 @@ updates: # (Jupiter/Vintage), not a drop-in update to junit:junit. - dependency-name: "junit:junit" versions: [">=5.0.0"] + groups: + android-gradle-plugin: + patterns: + - "com.android.*" + # KSP releases track Kotlin compiler versions, so they move together. + kotlin: + patterns: + - "org.jetbrains.kotlin*" + - "com.google.devtools.ksp*" + exclude-patterns: + - "org.jetbrains.kotlinx*" + apollo: + patterns: + - "com.apollographql*" + androidx: + patterns: + - "androidx.*" + android-test: + patterns: + - "junit:junit" + - "org.assertj*" + - "org.awaitility*" + - "org.mockito*" + - "org.robolectric*" - # Android sample app + # Android sample app. Its catalog dependencies are covered by the Android library + # entry above, so only update what the sample's own Gradle build declares. - package-ecosystem: gradle directory: "/platforms/android/samples/CheckoutKitAndroidDemo" schedule: - interval: weekly - open-pull-requests-limit: 5 + interval: monthly cooldown: default-days: 7 - ignore: - # The sample includes the Android library as :lib, so library dependencies can - # appear in this Dependabot scan too. - # Keep Kotlin compiler/plugin updates on 2.x unless the consumer floor is - # deliberately re-evaluated. - - dependency-name: "org.jetbrains.kotlin.*" - versions: [">=3.0.0"] - # Keep the published stdlib dependency aligned with the Kotlin API/language - # consumer floor, not the newer compiler used to build the AAR. - - dependency-name: "org.jetbrains.kotlin:kotlin-stdlib" - versions: [">=2.1.0"] - # Keep kotlinx-serialization on 1.7.x while the library's Kotlin API/language - # consumer floor is pinned to 2.0. - - dependency-name: "org.jetbrains.kotlinx:kotlinx-serialization-json" - versions: [">=1.8.0"] - # WebKit 1.16 raises minSdk to 24 and requests Kotlin stdlib 2.1. Keep the - # library's minSdk 23 / Kotlin 2.0 consumer baseline until it is deliberately revised. - - dependency-name: "androidx.webkit:webkit" - versions: [">=1.16.0"] - # Keep JUnit on 4.x. JUnit 5 is a test-platform migration - # (Jupiter/Vintage), not a drop-in update to junit:junit. - - dependency-name: "junit:junit" - versions: [">=5.0.0"] - groups: - apollo: - patterns: - - "com.apollographql.apollo*" + allow: + - dependency-name: "gradle-wrapper" + - dependency-name: "org.gradle.toolchains.foojay-resolver-convention" # React Native — root pnpm workspace - package-ecosystem: npm directory: "/platforms/react-native" schedule: - interval: weekly + interval: monthly cooldown: default-days: 7 ignore: @@ -92,12 +104,16 @@ updates: update-types: - "version-update:semver-major" - "version-update:semver-minor" + groups: + react-native: + patterns: + - "*" # React Native — Checkout Kit module - package-ecosystem: npm directory: "/platforms/react-native/modules/@shopify/checkout-kit-react-native" schedule: - interval: weekly + interval: monthly cooldown: default-days: 7 ignore: @@ -105,24 +121,33 @@ updates: update-types: - "version-update:semver-major" - "version-update:semver-minor" + groups: + react-native-module: + patterns: + - "*" - # React Native — sample app + # React Native — sample app. Native module updates also need `dev rn pod-install`, + # so grouping them means one Podfile.lock refresh per update cycle. - package-ecosystem: npm directory: "/platforms/react-native/sample" schedule: - interval: weekly + interval: monthly cooldown: default-days: 7 ignore: - dependency-name: "*" update-types: - "version-update:semver-major" + groups: + react-native-sample: + patterns: + - "*" # React Native — sample iOS CocoaPods (via Bundler/Gemfile) - package-ecosystem: bundler directory: "/platforms/react-native/sample" schedule: - interval: weekly + interval: monthly cooldown: default-days: 7 ignore: @@ -130,39 +155,41 @@ updates: update-types: - "version-update:semver-major" - "version-update:semver-minor" + groups: + react-native-sample-gems: + patterns: + - "*" # Protocol tooling - package-ecosystem: npm directory: "/protocol" schedule: - interval: weekly + interval: monthly cooldown: default-days: 7 - groups: - vitest: - patterns: - - "vitest" - - "@vitest/*" ignore: - dependency-name: "*" update-types: - "version-update:semver-major" - "version-update:semver-minor" + groups: + protocol-tooling: + patterns: + - "*" # Web — @shopify/checkout-kit - package-ecosystem: npm directory: "/platforms/web" schedule: - interval: weekly + interval: monthly cooldown: default-days: 7 - groups: - vitest: - patterns: - - "vitest" - - "@vitest/*" ignore: - dependency-name: "*" update-types: - "version-update:semver-major" - "version-update:semver-minor" + groups: + web: + patterns: + - "*" diff --git a/platforms/android/gradle/libs.versions.toml b/platforms/android/gradle/libs.versions.toml index 951b74c69..866e07a09 100644 --- a/platforms/android/gradle/libs.versions.toml +++ b/platforms/android/gradle/libs.versions.toml @@ -5,8 +5,8 @@ embeddedCheckoutProtocolAndroidRelease = "2026.08.25.1-alpha.1" # Published protocol version consumed by Checkout Kit. embeddedCheckoutProtocolAndroid = "2026.08.25.1-alpha.1" -androidApplicationGradlePlugin = "9.3.1" -androidLibraryGradlePlugin = "9.3.1" +# com.android.application and com.android.library must share one AGP version per build. +androidGradlePlugin = "9.3.1" apollo = "5.1.0" apolloCache = "1.0.7" assertj = "3.27.7" @@ -77,8 +77,8 @@ timber = { module = "com.jakewharton.timber:timber", version.ref = "timber" } tink-android = { module = "com.google.crypto.tink:tink-android", version.ref = "tink" } [plugins] -android-application = { id = "com.android.application", version.ref = "androidApplicationGradlePlugin" } -android-library = { id = "com.android.library", version.ref = "androidLibraryGradlePlugin" } +android-application = { id = "com.android.application", version.ref = "androidGradlePlugin" } +android-library = { id = "com.android.library", version.ref = "androidGradlePlugin" } apollo = { id = "com.apollographql.apollo", version.ref = "apollo" } binary-compatibility-validator = { id = "org.jetbrains.kotlinx.binary-compatibility-validator", version.ref = "kotlinxBinaryCompatibilityValidator" } detekt = { id = "io.gitlab.arturbosch.detekt", version.ref = "detekt" }