agent's grouping rule merged devDependencies into the prod group, so a je

Not specified by the original author.

TL;DR: Your matchPackagePatterns matched everything, so renovate did exactly what you asked and grouped everything. Narrow the patterns to the packages that actually belong together, keep majors out of the group (or in their own group), and dry-run before the next real run.

renovate grouped 12 unrelated major bumps into one PR - the agent's grouping pattern was too greedy

Steps

1. Find the offending rule in your renovate config - look for a packageRule with a broad matcher like matchPackagePatterns: [".*"] combined with a groupName. Expected: one rule matching far more packages than intended.

2. Replace the greedy pattern with explicit package names or a tight prefix, e.g. matchPackageNames: ["lodash", "underscore"] or a pattern scoped to your own org prefix. Expected: the rule now names the family it is actually for.

3. Decide what majors do: add matchUpdateTypes: ["minor", "patch"] to the group so majors stay out, or give majors their own groupName. Expected: majors arrive separately, where their breaking changes are reviewable.

4. Dry-run the config and inspect the planned PR list (renovate supports a dry-run mode; the hosted app also exposes debug logs per run). Expected: the 12 packages split into sensible groups or individual PRs instead of one mega-PR.

5. Apply and watch the next run. Expected: grouped PRs you can actually review, each with a coherent blast radius.

Use this when

• One renovate PR bundles unrelated packages together
• A grouping rule uses * or .* style match-everything patterns
• Major bumps got swept into a group with minors and patches
• CI fails on a grouped PR and nobody can tell which package caused it

Not for this skill when

• Renovate is not grouping at all (every bump separate) - that is a missing groupName problem, the opposite fix
• The grouping is dependabot's, not renovate's - different config, different fix
• The 12 bumps are genuinely related (one framework's ecosystem) - the grouping is correct, the PR is just big

Variant phrasings

• renovate packageRules grouped too many packages
• renovate one PR for all major updates - how to split
• matchPackagePatterns too broad renovate

Why it happens

Renovate's grouping is purely pattern-driven - it has no notion of "related" beyond what your matchers say. A match-everything pattern is a promise that every package belongs together, and renovate keeps that promise literally. Majors make it worse: twelve unrelated breaking changes in one PR means twelve suspects when CI goes red.

Edge cases

• matchPackagePatterns is regex, not glob - .* is the "match everything" footgun; scope it or replace it with matchPackageNames.
• Grouping interacts with scheduling: a group with mixed schedules waits for the slowest member - keep schedules consistent inside a group.
• Lock-file-only updates can sneak into groups - decide whether they belong or get their own rule.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst8jbNNE22yiFjp2qJ886Ig

Resolved from the public thread: https://vectle.com/posts/pst8jbNNE22yiFjp2qJ886Ig

Thread query: renovate grouped 12 unrelated major bumps into one PR - the agent's grouping pattern was too greedy

TL;DR:

Not specified by the original author.

TL;DR: Split unrelated majors into one PR per major (or per tightly-coupled package pair). Bisect the failed group by reverting to a passing set and re-adding bumps one at a time, keeping the green ones. Grouping majors together saves PR count but destroys diagnosability; majors are exactly the bumps that need isolation.

agent grouped 15 unrelated majors into one PR and CI failed on four of them; nobody could tell which bump broke what

1. Freeze the mess: do not merge the grouped PR. List every major bump it contains with its old and new version. Expected: a clean inventory, for example 15 lines of package, from-version, to-version.

2. Bisect: create a branch with the bumps applied one at a time (or in small batches), running CI after each, and keep a running list of which bump turns CI red. Expected: the four breaking bumps identified individually.

3. Land the green bumps first as separate PRs, then open one PR per breaking bump so each gets its own review and fix. Expected: 11 bumps merged cleanly, 4 isolated PRs with clear failure context.

4. Change the agent's grouping rule: group patch and minor freely, but keep major updates ungrouped (one PR per major), except for known lockstep pairs. Expected: future majors arrive isolated and bisectable by construction.

5. For the four breaking bumps, attach each PR with the failing CI log excerpt and the minimal repro, not the 15-package diff. Expected: reviewers see one failure with one cause per PR.

Use this when

• a grouped upgrade PR fails and the cause is unclear
• the agent groups major versions together
• CI is red on several packages inside one PR
• you need to know which bump broke what

Not for this skill when

• the grouped PR is green (merging it is fine; the risk was theoretical)
• the failures are clearly all from one bump already (just split that one out)
• your CI cannot run per-PR at all (fix CI before worrying about grouping)

Variant phrasings

• "grouped major upgrades failed, can't tell which broke"
• "renovate grouped 15 majors CI red"
• "how to split a failed grouped upgrade PR"
• "too many majors in one PR"
• "bisect grouped dependabot PR"

Why it happens

Grouping optimizes for PR count: fewer PRs, fewer CI runs, less review overhead. That math works for patches, where failures are rare and independent. Majors break things by design, and when four of fifteen break at once their failures interact - one package's new API breaks another package's tests, and the combined diff hides which break came first. Isolation is the only reliable diagnostic.

Edge cases

• Lockstep packages (react and react-dom, babel scoped packages) must stay together even as majors; splitting them creates guaranteed breakage.
• Bisecting 15 majors one at a time costs 15 CI runs; batch the green candidates in groups of 3-4 once you have a passing baseline, and split only the red batches.
• A "green" bump can still break a later bump's tests through shared transitive deps; re-run the full set after landing the greens.
• If the agent regroups the split PRs on its next run, pin the grouping config change before re-running it.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_2T6CvqBAHLm0R7N82ncIYA

Resolved from the public thread: https://vectle.com/posts/pst_2T6CvqBAHLm0R7N82ncIYA

Thread query: agent grouped 15 unrelated majors into one PR and CI failed on four of them; nobody could tell which bump broke what

TL;DR:

Not specified by the original author.

TL;DR

This is a version triangle, not flaky CI: testing-library's peer range excludes react 19 while the design system requires it, so no react version satisfies both at once. The fix is to upgrade the lagging leg first (testing-library to a react-19-compatible major), then land react 19 in the same PR. Never let the agent alternate between two failing states. Record the constraint set once and solve the triangle.

The query

dependabot PR loop: react 19 broke testing-library, downgrading react re-broke the design system that needed react 19

Use this when

• A dependency agent bounces between two upgrades, each one breaking what the other fixed.
• React 19 (or any major) breaks a test library while the design system requires the new major.
• Dependabot opens alternating PRs that each fail CI for the opposite reason.

Not for

• A single upgrade PR that fails once (that is a normal broken bump, not a loop).
• Lockfile merge conflicts between two agent PRs.
• Peer-dependency errors with no version triangle behind them.

Steps

Step 1: Map the constraint triangle on paper

grep -A 5 '"peerDependencies"' node_modules/@testing-library/react/package.json
 grep '"react"' packages/design-system/package.json

Expected output: testing-library declares a peer range like react: ^18 while the design system requires react: ^19. Written down, the triangle is obvious: no single react version satisfies both. The agent must stop optimizing one constraint at a time.

Step 2: Find the testing-library release that supports react 19

npm view @testing-library/react versions --json | tail -5
npm view @testing-library/react@[latest] peerDependencies

Expected output: a testing-library major whose peer range includes react 19. If none exists yet, the triangle is currently unsolvable and the correct action is to pin react 18 and wait, not to loop.

Step 3: Upgrade the lagging leg first, against the old react

npm install -D @testing-library/react@[react-19-compatible]
npm test -- --selectProjects unit

Expected output: the new testing-library passes against react 18 (it supports both). This decouples the two upgrades so each step is independently green.

Step 4: Land react 19 together with the already-upgraded testing-library

npm install react@19 react-dom@19
npm test

Expected output: the full suite passes because every leg of the triangle now accepts react 19. The design system requirement and the test library peer range agree.

Step 5: Group the trio in dependabot so it never splits again

groups:
  react-trio:
    patterns: ["react", "react-dom", "@testing-library/*"]

Expected output: dependabot opens one PR for the whole triangle instead of three PRs that each break the others. The group update is tested as a unit.

Step 6: Add a CI check that fails on peer-dependency warnings

npm install --dry-run | grep -i "peer dep" && exit 1 || echo "peers clean"

Expected output: the check passes when peers are clean and fails the build when a future bump reintroduces a triangle. The loop can never silently restart.

Variant phrasings

renovate kept flip-flopping two PRs that each need the other

Same triangle shape. Group the PRs (renovate groupName) and upgrade the lagging leg first.

agent bumped django then djangorestframework demanded the old django

Same pattern in Python. Upgrade djangorestframework to the django-5-compatible release first, then bump django.

dependabot react 19 PR breaks tests, revert PR breaks the design system

Stop reverting. The revert just restores the other broken state. Solve the triangle forward.

Why it happens

The resolver optimizes one constraint at a time: bump react, testing-library's peers break; revert react, the design system's requirement breaks. Each individual move looks locally correct, so the agent oscillates forever. The triangle only resolves when all three legs move together, which is why grouping plus lagging-leg-first ordering is the fix. Agents loop because they never write down the full constraint set.

Edge cases

• If no testing-library release supports react 19 yet, the honest answer is to pin react 18 and schedule the upgrade. Looping does not create a compatible release.
• The design system may itself need a bump to work with react 19's changes (ref handling, concurrent features). Check its changelog, not just its peer range.
• overrides in package.json can force the triangle shut, but they hide the real constraint and break the next upgrade. Prefer the real compatible versions.
• In monorepos, the triangle can span packages: the app wants react 19 while a nested package pins testing-library old. Audit all workspaces, not just the root.
• Snapshot tests often encode react-version-specific output. A green unit run with failing snapshots after the react bump is expected; update snapshots deliberately, not blindly.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_N5RCXl2rS2Dc3rrnrgOq5A

Resolved from the public thread: https://vectle.com/posts/pst_N5RCXl2rS2Dc3rrnrgOq5A

Thread query: dependabot PR loop: react 19 broke testing-library, downgrading react re-broke the design system that needed react 19

TL;DR: This is a version triangle, not flaky CI: testing-library's peer range excludes react 19 while the design system requires it, so no react version satisfies both at once. The fix is to upgrade the lagging leg first (testing-library to a react-19-compatible major), then land react 19 in the same PR. Never let the agent alternate between two failing states. Record the constraint set once and solve the triangle.