🔧 Disable renovate immortal PRs for expo and react#101
Open
Friedinger wants to merge 1 commit into
Open
Conversation
WalkthroughRenovate configuration is updated to prevent automatic package recreation for expo ecosystem dependencies and React source packages by setting ChangesRenovate Configuration
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (3)
.github/renovate.json (3)
12-15: 💤 Low valueConsider adding a
groupNamefor clarity.Adding a descriptive
groupName(e.g.,"react core packages") would improve consistency with the expo ecosystem rule and make Renovate's PR grouping behavior more transparent.♻️ Suggested addition
{ "matchSourceUrls": ["https://github.com/facebook/react"], + "groupName": "react core packages", "recreateWhen": "never" }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/renovate.json around lines 12 - 15, Add a descriptive Renovate group name to the rule that matches React source URLs: in the JSON object containing "matchSourceUrls": ["https://github.com/facebook/react"] and "recreateWhen": "never", add a "groupName" property (for example "react core packages") so PRs from this rule are clearly grouped and consistent with the expo ecosystem rule.
10-10: Operational consideration: Impact on security updates.Setting
recreateWhen: "never"means that if dependency update PRs are closed (intentionally or accidentally), Renovate will not recreate them. While this reduces "immortal PR" noise, it may cause important security updates to be missed if PRs are dismissed without merging.Consider establishing a process to periodically review dismissed PRs or use Renovate's dashboard to track skipped updates for these critical dependencies.
Also applies to: 14-14
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/renovate.json at line 10, The config currently sets "recreateWhen": "never", which prevents Renovate from recreating closed dependency PRs and risks missing security fixes; update the Renovate config so critical/security updates can be recreated—either remove or relax the global "recreateWhen" setting and add a packageRules entry that targets security/critical dependencies (or specific packages) with "recreateWhen": "always" (or a less restrictive value) to ensure those PRs are reprovisioned; keep the global setting only if you implement a periodic review process or dashboard monitoring for dismissed PRs.
12-15:matchSourceUrlssupports exact URL strings;.gitsuffix isn’t required
"https://github.com/facebook/react"is a valid literal formatchSourceUrls(it also supports glob/regex patterns).- Renovate matches against the package
sourceUrlit learns/infers, so whether sources include.gitisn’t enforced—use the format you actually see, or switch to a glob/regex if matching is inconsistent.- Adding
groupNameis optional (not needed for correctness).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/renovate.json around lines 12 - 15, The Renovate config uses matchSourceUrls with the literal "https://github.com/facebook/react"; ensure you keep the exact URL string that Renovate will see (no .git suffix needed) in the matchSourceUrls array and leave recreateWhen as "never" unchanged, or if you need broader matching switch matchSourceUrls to a glob/regex pattern (e.g., a GitHub repo pattern) instead of altering the literal; you can also omit groupName since it’s optional.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/renovate.json:
- Around line 12-15: Add a descriptive Renovate group name to the rule that
matches React source URLs: in the JSON object containing "matchSourceUrls":
["https://github.com/facebook/react"] and "recreateWhen": "never", add a
"groupName" property (for example "react core packages") so PRs from this rule
are clearly grouped and consistent with the expo ecosystem rule.
- Line 10: The config currently sets "recreateWhen": "never", which prevents
Renovate from recreating closed dependency PRs and risks missing security fixes;
update the Renovate config so critical/security updates can be recreated—either
remove or relax the global "recreateWhen" setting and add a packageRules entry
that targets security/critical dependencies (or specific packages) with
"recreateWhen": "always" (or a less restrictive value) to ensure those PRs are
reprovisioned; keep the global setting only if you implement a periodic review
process or dashboard monitoring for dismissed PRs.
- Around line 12-15: The Renovate config uses matchSourceUrls with the literal
"https://github.com/facebook/react"; ensure you keep the exact URL string that
Renovate will see (no .git suffix needed) in the matchSourceUrls array and leave
recreateWhen as "never" unchanged, or if you need broader matching switch
matchSourceUrls to a glob/regex pattern (e.g., a GitHub repo pattern) instead of
altering the literal; you can also omit groupName since it’s optional.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 8ec682c6-9452-4fae-b903-74e8ae466492
📒 Files selected for processing (1)
.github/renovate.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request updates the Renovate configuration to improve control over dependency update behavior, specifically for the Expo and React ecosystems, as well as for dependencies sourced from Facebook's React repository.
Dependency update configuration changes:
.github/renovate.jsonto set"recreateWhen": "never", preventing Renovate from recreating pull requests for these dependencies..github/renovate.jsonthat prevents the recreation of pull requests for dependencies with source URLs fromhttps://github.com/facebook/react.