Root causes (this round):
- dependabot.yml had been overwritten to a minimal version with NO
ignore rules -> major bumps allowed (typescript 7, eslint 10, tsparticles 4)
- main branch had NO branch protection -> 'gh pr merge --auto' merged
even with failing CI
- auto-merge workflow had no check-run verification step
Fixes:
- Branch protection on main: required status check 'lint + typecheck +
test + build' (strict) so auto-merge cannot land failing changes
- dependabot-auto-merge.yml: verify CI check-run conclusion == success
(actions/github-script poll with timeout) before enabling auto-merge
- dependabot.yml: restore ignore rules for eslint/typescript/@tsparticles
majors + eslint-config-next + eslint-plugin-react
- Rollback toolchain to known-good exact pins:
typescript 6.0.3, eslint 9.39.5, @tsparticles/{react,engine,slim} 3.x
(exact versions, no ranges dependabot can widen)
- Close dependabot PR #19 (tsparticles 4.4.0)
- dependabot ignore for npm does NOT support wildcards (only groups.patterns
does). The '@tsparticles/*' rule was silently ignored -> v4 bumps kept
landing. Replace with exact scoped names.
- bump actions/checkout v5->v7 (closes dependabot PR #5); the CI failure on
that PR was a stale-branch format-check, not checkout v7.
Open @tsparticles PRs now closed (#9 already closed earlier).
Middlewate file convention is deprecated in Next 16.3.5 (renamed to proxy).
git mv middleware.ts -> proxy.ts, rename exported fn middleware -> proxy.
Build now emits `ƒ Proxy (Middleware)` with no deprecation warning.
asepharyana
asepharyana