[finding] Dependabot splits `react` and `react-dom`, so every react patch arrives as a PR that cannot merge on its own

[os-zhuang]

Found by the repo:objectos execution seat (objectstack#9831) while landing #157 / PR #158. Filed unassigned; recording it, not grading it.

What happened, concretely

react-dom 19.2.6 → 19.2.7 was one of three bumps consolidated into ee74379. Regenerating the lockfile with the natural caret declaration ^19.2.7 did not resolve to 19.2.7 — react-dom@19.2.8 had published upstream in the meantime, so it resolved there and immediately broke:

apps/docs
└─┬ react-dom 19.2.8
  └── ✕ unmet peer react@^19.2.8: found 19.2.7

react-dom@X peer-requires react@^X. react sat at 19.2.7 and was out of scope for that card, so the bump was landed by pinning react-dom exact at 19.2.7.

That unblocked the immediate work. It did not fix the shape underneath it.

The shape

Dependabot files react and react-dom as separate PRs, and they are not separately mergeable. A react-dom PR that arrives alone always carries a peer requirement its sibling PR is holding. Whoever picks it up has three options, and two of them are wrong:

1. Merge the pair together — correct, but nothing in the PRs says they are a pair, and each one's checks pass in isolation on its own base.
2. Bump react inside the react-dom PR — widens a scoped change silently.
3. Pin around it — what chore(deps): consolidate react-dom, tailwindcss, @tailwindcss/postcss bumps #158 did, deliberately and as a bounded call, but it is a workaround, not a fix.

This is not hypothetical or one-off: it is what these two packages do on every patch release, and this repo already accumulated a month-stale react-dom PR partly because of it.

A second-order effect the pin introduced

The two declarations now have different shapes:

"react":     "^19.2.7",   // floats
"react-dom": "19.2.7",    // pinned

Both resolve to 19.2.7 today, so nothing is broken now. But a future non-frozen install can float react upward while react-dom stays put. The peer range ^19.2.7 permits that, so no tool complains — while React itself expects the two to be the same version. That is a mismatch which is silent at install time and only shows up at runtime, which is the worst place for it.

The fix has a precedent already in this repo

.github/dependabot.yml already uses grouping:

    groups:
      objectstack:
        patterns:
          - "@objectstack/*"

A react group covering react, react-dom, @types/react, @types/react-dom would make Dependabot file them as one PR, which is the shape that is actually mergeable. That is a few lines in a file that already does this, not a new mechanism.

Whoever takes it should also decide whether react-dom's exact pin stays or reverts to a caret once the two move together — grouping removes the reason the pin exists, and leaving both would be belt-and-braces rather than a contradiction.

Not claimed

• I have not checked whether @types/react / @types/react-dom have the same coupling — they are versioned independently of the runtime packages and may not need to be in the group.
• I have not checked whether grouping interacts with the existing @objectstack/* group in any way that needs care.

Back-links: #157, PR #158, closed-as-superseded #49.

[os-zhuang]

Triage: pm:queue, Task. Add a react group (react, react-dom, and — after checking their coupling as the card flags — @types/react*) to .github/dependabot.yml, following the existing @objectstack/* group precedent; decide in the same PR whether react-dom's exact pin reverts to caret (grouping removes the pin's reason — reverting is the cleaner end state, state the choice either way).

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 1
Session: session_016TUrhcggSFrYctvp5dsV1A
Branch: claude/issue-159-dependabot-react-group
Worktree: objectos-issue-159
Domain: n/a — objectos is a single-lane repo and carries no domain:* labels
File surface: .github/dependabot.yml, and apps/docs/package.json only if you take the pin-revert (see below) (stop on breach; explain in the report)
Container & model: S, mode:subagent, model: sonnet — dispatch-gates.mjs --tier reports no path-derived mandate for objectos paths, so the tier is this seat's call. Floor: the mechanism already exists in this file and the change is a few lines. .github/** is not a governed surface in this repo, so this lands through the queue like any other card.
Clause-②: no
Serial constraints cleared: .github/dependabot.yml is touched by no in-flight PR and by no other queued card. #154 is in a patch round on configure/permissions/permission-sets.mdx and #165 is in flight on .github/workflows/ + a new scripts/pm/ tree — both disjoint from this file. ⚠️ Five Dependabot PRs are open (#160–#164) and all of them rewrite pnpm-lock.yaml; you are changing Dependabot's config, not the lockfile, so you do not collide with them — but do not touch the lockfile.

---

Premise re-check, run at dispatch on origin/main @ c57b612

Everything the card asserts is intact:

• .github/dependabot.yml already uses groups: for @objectstack/* — the precedent is real and is the shape to copy.
• apps/docs/package.json carries exactly the asymmetry described: "react": "^19.2.7" (floats) beside "react-dom": "19.2.7" (pinned exact).

⚠️ The trap I measured, which the card does not name

lucide-react is in the same manifest ("lucide-react": "^1.16.0") and has its own open Dependabot PR (#161). A naive pattern — react*, *react*, or anything glob-shaped around the word — swallows it into your new group, silently coupling an unrelated icon library's updates to React's. That would be a worse bug than the one this card fixes, and nothing would fail: you would just get one confusing combined PR later.

Enumerate the packages explicitly. react and react-dom are certainly the group. Whether @types/react / @types/react-dom join is your call — and the card flags it as unmeasured, so here is the measurement: they are on different versions from each other (^19.2.17 and ^19.2.3), which is evidence they really do float independently of the runtime pair and of one another. Argue whichever way you land; do not include them just because the names look similar.

PM mechanism assumptions (test these; falsifying one is a good outcome)

• I assume adding a second group alongside objectstack needs no other change — same ecosystem, same directory. Check Dependabot's schema rather than assuming two groups compose; if a patterns entry in one group can shadow the other, say so.
• I assume grouping is the right mechanism at all. If Dependabot has since gained something better suited to peer-coupled packages, use it and say why.

The second-order question the card raises, which is yours to decide

Grouping removes the reason react-dom's exact pin exists (#158 pinned it as a bounded workaround). The card asks whether the pin reverts to a caret. My read: reverting is the honest end-state — leaving both a group and a pin is belt-and-braces that hides which mechanism is load-bearing, and the pin's own second-order hazard (a non-frozen install floating react above a pinned react-dom, which no tool complains about) is real. But it means touching apps/docs/package.json, and a pnpm install to regenerate the lockfile would collide with the five open Dependabot PRs.

So: take the revert only if it costs no lockfile change (both already resolve to 19.2.7, so a caret that resolves to the same version may be a manifest-only edit — verify, do not assume). If it would rewrite pnpm-lock.yaml, do not do it here — report it and I will file it as its own card. ⛔ deploy-docs.yml fires a production deploy on every pnpm-lock.yaml push to main, so lockfile churn in this repo has a blast radius no required check covers. That is the reason for the caution, not tidiness.

Verification

There is no gate in this repo that validates dependabot.yml, so "CI green" proves little here — say so rather than implying the green covers it. What you can do: confirm the YAML parses, confirm the two groups are structurally distinct, and reason explicitly about which of the five open Dependabot PRs your pattern set would and would not have captured. That last one is the real test of the pattern.

Still run the repo's gates from the repo root (pnpm turbo run build, pnpm turbo run test, node .github/scripts/check-locale-surface.mjs — wrong cwd exits 1 with MODULE_NOT_FOUND, an invocation error not a red gate). Use --force; capture exit codes before any pipe.

Reporting

Post your report as a comment on this issue first, then return it. The sanitizer eats a leading HTML-comment marker — fall back to a literal first line os-dev-report. Read it back with a GET, never PATCH. Leave your own claim comment with your session ID and branch before you start implementing — the claim is what makes a race detectable while the work is happening. I hold the assignee field; do not touch it. premise_still_valid: false with no PR is a legitimate delivery.

⛔ Do not comment on or otherwise drive any Dependabot PR. A sanitizer in this tooling rewrites @dependabot mentions on write, so those commands cannot be issued from here at all; two sessions have already burned time discovering that.

---

Generated by Claude Code

[os-zhuang]

Claim (dev): starting implementation now.
Session: session_016TUrhcggSFrYctvp5dsV1A
Branch: claude/issue-159-dependabot-react-group
Worktree: objectos-issue-159

---

Generated by Claude Code

[os-zhuang]

os-dev-report

{
  "issue": 159,
  "status": "done",
  "branch": "claude/issue-159-dependabot-react-group",
  "pr": "https://github.com/objectstack-ai/objectos/pull/236",
  "premise_still_valid": true,
  "summary": "Added an explicit `react` group (patterns: react, react-dom only) to .github/dependabot.yml alongside the existing objectstack group, so a react-dom bump and its peer-required react bump land as one mergeable PR instead of two independently-unmergeable ones. Enumerated exact package names rather than a react*-shaped pattern, since apps/docs/package.json also carries lucide-react (an unrelated icon library with its own open Dependabot PR #161) which a wildcard would have silently swallowed. Excluded @types/react / @types/react-dom: measured they already float independently of each other (^19.2.17 vs ^19.2.3) and, more importantly, the peerDependencies coupling this issue is about exists only between the runtime react/react-dom packages, not the type-only ones. On the second-order pin-revert question: tested (not assumed) whether reverting react-dom's exact pin to a caret costs a pnpm-lock.yaml change via `pnpm install --lockfile-only` -- it does (the `specifier:` line changes even though the resolved `version:` doesn't), so per the card's constraint I left the pin as-is and reported the finding (one-line diff, already verified) in the PR body rather than landing it here.",
  "tests": "pnpm turbo run build -> exit 0 (full docs build succeeded, 1140 pages). pnpm turbo run test -> exit 0 (cached FULL TURBO, includes check-locale-surface self-tests). node .github/scripts/check-locale-surface.mjs (run from repo root) -> exit 0, 0 unexpected/missing/duplicated. No gate in this repo validates dependabot.yml itself, so the above proves the change didn't break anything else, not that the Dependabot config is correct -- for that: confirmed .github/dependabot.yml parses via python yaml.safe_load; confirmed the objectstack and react groups are structurally distinct (disjoint pattern sets, verified programmatically, no shared strings); verified against GitHub's own docs (github/docs dependabot-options-reference.md, fetched raw) that groups in one update block compose via first-match-wins precedence with no shadowing risk given disjoint patterns, and that `patterns`/`exclude-patterns` only interact via wildcard matches (not relevant here since names are literal); read the 5 currently-open Dependabot PRs (#160 fumadocs-core, #161 lucide-react, #162 @opennextjs/cloudflare, #163 wrangler, #164 @types/negotiator) and confirmed none is react/react-dom, so this change doesn't retroactively touch any of them -- its effect is on the next react/react-dom bump. Pin-revert ablation: edited apps/docs/package.json react-dom to ^19.2.7, ran `pnpm install --lockfile-only`, diffed pnpm-lock.yaml against a pre-edit copy (specifier line changed, version line did not), then restored both files via `git checkout HEAD --` and confirmed byte-identical sha256 back to the original.",
  "mcp_calls": "10",
  "open_questions": [],
  "out_of_scope_findings": []
}

---

Generated by Claude Code

[os-zhuang]

ACCEPT — PR #236. Driving to landing.

Checklist: draft ✓ · base main ✓ · Fixes #159 on the first line ✓ · one file, +4/−0, exactly the declared surface — the pin experiment was reverted, so apps/docs/package.json and pnpm-lock.yaml are untouched ✓ · no changeset expected ✓ · every check on its own conclusion: build success, Node floor success, and .github/dependabot.yml success.

That third check is worth naming, because it is better evidence than you claimed to have. Your verification-honesty section says no gate in this repo validates dependabot.yml. That is right about repo-owned gates — but changing this file caused GitHub's own Dependabot config validator to post a check run (from dependabot-api.githubapp.com), and it passed. So the config is machine-validated after all, just not by anything in .github/workflows/. Understating your evidence is the right direction to err in; recording the correction so the next card on this file knows the check exists.

Ownership & freshness is absent from this PR and that is correct — translations.yml is path-filtered to content/docs, and this PR touches .github/ only. Verified rather than assumed, per the standing rule that a gate's absence can be legitimate.

The trap was avoided for the stated reason. lucide-react sits in the same manifest with its own open PR (#161); the group enumerates react and react-dom as literal names, so it cannot reach it. Confirmed in the diff.

You answered my schema question with a source, not a shrug. "If a dependency matches more than one rule, it's included in the first group that it matches" — that is the precedence rule I asked about, and noting that @objectstack/* and the bare names are disjoint regardless of declaration order is the part that makes the answer durable for whoever adds a third group here.

Excluding @types/react* is right, and your reason is better than mine. I offered the version-skew observation; you went to the mechanism — the coupling this card exists to fix is an npm-enforced peerDependencies requirement between the runtime packages, and DefinitelyTyped's type-only packages do not carry it. That is a reason that stays true when the versions happen to line up, which mine would not have.

And the pin: you did the thing I asked and got the answer I did not expect. I said take the caret revert only if it costs no lockfile change, and to verify rather than assume. You ran it and found pnpm-lock.yaml is not byte-identical — the resolved version: holds at 19.2.7(react@19.2.7) but the specifier: field moves — then reverted the experiment rather than shipping it. That is exactly right, and the reason matters: deploy-docs.yml fires a production deploy on every pnpm-lock.yaml push to main, so a "cosmetic" one-line lockfile diff would have shipped a production deploy through this PR. Reporting the exact diff instead of the change is the more useful delivery.

Deviations: none. No Dependabot PR was commented on or driven.

Filing your follow-up as its own card, with your measured diff, rather than leaving it in a PR body where nothing will find it again.

Path-surface check before flipping ready: .github/dependabot.yml — .github/** is not a governed surface in this repo, so this lands through the queue.

---

Generated by Claude Code