mirror of
https://github.com/pgadmin-org/pgadmin4.git
synced 2026-08-17 16:34:44 -05:00
Dave Page
7790264acb
We were carrying 27 open Dependabot PRs, the great majority of them single patch bumps of transitive packages, and the review cost of that queue is entirely out of proportion to its risk. Every genuine problem found whilst clearing it (paramiko 5.0 breaking sshtunnel, use-resize-observer 10.0 dropping its default export, jest-dom 7.0 requiring a newer Node) was a major bump. Group minor and patch updates into a single weekly PR per manifest, and leave major updates arriving individually so each still gets its own review. Grouping applies to version updates only, so security updates are unaffected and continue to arrive as separate PRs.