Skip to content

chore: fix dependabot errors - #555

Merged
doherty100 merged 1 commit into
vnextfrom
chore/dependabot-updates
Jul 14, 2026
Merged

chore: fix dependabot errors#555
doherty100 merged 1 commit into
vnextfrom
chore/dependabot-updates

Conversation

@doherty100

Copy link
Copy Markdown
Contributor

Purpose

  • Fix dependabot version errors

Does this introduce a breaking change?

[ ] Yes
[ X ] No

Pull Request Type

What kind of change does this Pull Request introduce?

[ ] Bugfix
[ ] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[ ] Documentation content changes
[ X ] Other... Please describe: depandabot configuration changes

How to Test

  • Provision a new sandbox environment
  • Run unit tests

What to Check

Verify that the following are valid

  • Unit tests should all pass.

Other Information

@doherty100
doherty100 merged commit 32adf70 into vnext Jul 14, 2026
16 checks passed
@doherty100
doherty100 deleted the chore/dependabot-updates branch July 14, 2026 14:44
@doherty100

Copy link
Copy Markdown
Contributor Author

Root-cause analysis: why this change was needed

Summary

Nothing changed in this repo's dependabot.yml or on the Terraform side. A Dependabot service update on 2026-07-13 tightened config validation and began rejecting the long-tolerated, Terraform-unsupported versioning-strategy key, which silently killed that week's update run. Removing the key (this PR) restores normal operation.

Timeline (from this repo's Dependabot PR history)

versioning-strategy: increase was present on all terraform jobs the whole time (added 2026-03-26 in #260, "chore: update terraform providers" — undocumented/incidental), yet weekly grouped PR batches ran fine every Monday:

Scheduled Monday Dependabot PRs opened
2026-06-08 4 (#441#444)
2026-06-15 14 (#449#462)
2026-06-22 14 (#476#489)
2026-06-29 14 (#502#515)
2026-07-06 14 (#528#541)
2026-07-13 0 — first missed run in the entire history
2026-07-14 this PR (#555) removes versioning-strategy

The last successful automated batch (#528#541, azurerm ~> 4.79.0~> 4.80.0) was created with the key still present, confirming it was harmless/tolerated for months.

What actually changed

  • versioning-strategy is ecosystem-gated and has never been supported for the terraform ecosystem (it's still being rolled out per-ecosystem upstream — e.g. dependabot-core v0.386.0 added it for helm in helm: support versioning-strategy (range-preserving updates) dependabot/dependabot-core#15218).
  • Upstream config-parser hardening landed in dependabot-core v0.383.0 (2026-06-24) and v0.384.0 (2026-06-30) (e.g. Type the Dependabot config file parser dependabot/dependabot-core#15401 "Type the Dependabot config file parser"), moving validation toward fail-fast on unsupported keys.
  • The break date (2026-07-13) lands exactly on the publish of dependabot-core v0.386.0 (2026-07-13). When GitHub's hosted Dependabot picked up the stricter validation, the unsupported versioning-strategy on terraform now rejects the whole config, so no PRs were generated.

Caveat

There is no public GitHub changelog entry or REST endpoint stating "terraform now rejects versioning-strategy" — that validation is enforced server-side and the literal error only renders on the repo's Insights → Dependency graph → Dependabot page. The evidence here is behavioral (14 PRs every Monday for months → 0 on the exact day v0.386.0 shipped → manual key removal the next day), but it is conclusive.

Net effect of this PR

No change to how Terraform updates are proposed (the key was inert for terraform); it only removes the config-validation failure that had stopped the weekly runs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant