chore: make dependency range alignment opt-in - #10228
Merged
Merged
Conversation
cryptodev-2s
force-pushed
the
chore/make-dependency-range-alignment-opt-in
branch
from
September 14, 2026 14:38
be87913 to
797ac50
Compare
mcmire
reviewed
Sep 14, 2026
mcmire
left a comment
mcmire
left a comment
Collaborator
There was a problem hiding this comment.
This looks better, but do we also need to tell Dependabot to set this environment variable somehow?
Contributor
Author
Yes I will use the env variable in an upcoming PR |
cryptodev-2s
enabled auto-merge
September 14, 2026 16:32
cryptodev-2s
deleted the
chore/make-dependency-range-alignment-opt-in
branch
September 14, 2026 16:58
4 tasks
pull Bot
pushed a commit
to Reality2byte/core
that referenced
this pull request
Sep 15, 2026
## Explanation Dependabot's pull requests cannot merge on their own. Its security updates walk manifests one at a time rather than treating the Yarn workspace as one project, so a dependency ends up with different ranges in different packages and `yarn constraints` fails. It also does not deduplicate `yarn.lock` and does not write changelog entries. MetaMask#10147, MetaMask#10157, MetaMask#10177 and MetaMask#9369 are all stuck on this. This adds a workflow that repairs all three and pushes the result back. It runs `yarn constraints --fix` with `ALIGN_DEPENDENCY_RANGES=true` (the opt in from MetaMask#10228, whose only intended caller is this workflow), reinstalls, deduplicates, then runs the changelog fixer that already exists. Order matters: aligning ranges rewrites manifests but leaves `yarn.lock` stale. It also adds `@lavamoat/*` to the npm allowlist. Both that and `@metamask/*` are already in `npmPreapprovedPackages`, so neither can trip the Yarn age gate during the repair install. Note that `allow` only governs version updates, so the workflow will also act on security pull requests for other packages, which is where the constraints failures come from. ## Notes - `pull_request`, not `pull_request_target`. Dependabot runs get a read only token and no secrets, so the push is authorised by the OIDC exchange, the same way snaps does it. - `opened` and `reopened` only. The job pushes to the pull request branch, so `synchronize` would loop. - `[dependabot skip]` on the commit, otherwise Dependabot rebases and wipes the repair. ## Verification The workflow cannot run until it is on the default branch. Checked locally: | Check | Result | | --- | --- | | `constraints --fix` leaves `yarn.lock` stale | confirmed, hence the reinstall step | | `ALIGN_DEPENDENCY_RANGES=true yarn constraints --fix` on a split range | aligns all 25 manifests, exit 0 | | Default, without the variable | unchanged, still errors | ## References Follows MetaMask#10225 and MetaMask#10228. Part of WPC-1161. Pattern borrowed from MetaMask/snaps `update-pull-request.yml`. ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate (workflow and config only) - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [ ] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) (no published package is touched) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Changes are limited to Dependabot and CI workflow configuration; no runtime application or auth logic is modified, though the workflow does push commits to Dependabot branches via OIDC token exchange. > > **Overview** > Adds a GitHub Actions workflow that runs when **Dependabot** opens or reopens a PR, then fixes the common reasons those PRs fail CI: misaligned dependency ranges across the Yarn workspace, a stale or duplicated **yarn.lock**, and missing changelog entries. > > The job exchanges an OIDC token for write access (Dependabot’s default token cannot push), runs **`yarn constraints --fix`** with **`ALIGN_DEPENDENCY_RANGES=true`**, reinstalls with **`--no-immutable`**, dedupes, and runs the existing **`changelog:validate --fix`** flow before committing with **`[dependabot skip]`** so Dependabot does not rebase away the repair. It only listens to **`opened`** / **`reopened`** (not **`synchronize`**) to avoid a push loop. > > **Dependabot** config now allows version bumps for **`@lavamoat/*`** npm packages, matching **`@metamask/*`**, so those updates can go through the same repair path without Yarn age-gate issues during install. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit c90706d. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explanation
Follow up to #10225, addressing review feedback on it.
#10225 made the dependency range consistency constraint auto-fixable, which also made it fixable from
yarn lint:fix. That risks a team hitting a constraints error, reaching foryarn lint:fixto clear it, and folding a monorepo-wide dependency bump into an unrelated pull request. Upgrades should stay in their own Dependabot pull requests.This makes the alignment opt in and off by default. Every local invocation now behaves exactly as it did before #10225, same error, same wording. Only CI repairing a bot's pull request will opt in.
The mechanism is an environment variable rather than a flag because
yarn constraintsis a Yarn builtin and rejects anything other than--fixand--json:There is deliberately no package script wrapping it. A convenient front door is what would tempt someone into bundling an upgrade into unrelated work, which is the thing being fixed.
Verification
ALIGN_DEPENDENCY_RANGES=truenpm:uuid@^14.0.2)References
Follows #10225. Part of WPC-1161.
Checklist
yarn.config.cjs)Note
Low Risk
Only changes Yarn constraint fix behavior for monorepo manifest consistency; no runtime package code or published APIs.
Overview
Reverts the post-#10225 behavior where
yarn constraints --fix(including viayarn lint:fix) could automatically align mismatched semver ranges across workspaces to the highest range. By default, inconsistent dependency ranges again surface only the existing "Pick one" error with no manifest rewrites.Opt-in auto-alignment is gated on
ALIGN_DEPENDENCY_RANGES=true, intended for CI that repairs Dependabot PRs—not a CLI flag (Yarn’s builtin rejects extra options) and not a package script. Non-comparable ranges (aliases, protocols, dist tags) still always error, with or without the env var.Reviewed by Cursor Bugbot for commit cb57bdb. Bugbot is set up for automated code reviews on this repo. Configure here.