From 6bb9e548f140512b390bdd54ee6b4e5d9acd457c Mon Sep 17 00:00:00 2001 From: Martin Hochel Date: Tue, 25 Aug 2026 16:00:53 +0200 Subject: [PATCH] chore(deps): ban nx packages from dependabot updates --- .github/dependabot.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1c34cf3fd5..ee25085bdb 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -24,6 +24,14 @@ updates: ignore: - dependency-name: '*' update-types: ['version-update:semver-major'] + # Nx is upgraded exclusively via `yarn nx migrate`, which keeps the whole `nx`/`@nx/*` set + # version-locked and applies config codemods (nx.json, project.json, migrations.json). + # A Dependabot bump only touches package.json/yarn.lock, so it silently skips the codemods + # and can desync plugin versions from the Nx runtime. Banned outright, security updates + # included — those must go through `nx migrate` too. + - dependency-name: 'nx' + - dependency-name: '@nx/*' + - dependency-name: '@nrwl/*' groups: production-dependencies: dependency-type: 'production'