Dependabot tracks vitest and @vitest/coverage-v8 as independent packages, even though they're released in lockstep upstream and need matching versions to work correctly.
#1224 and #1227 show this in practice: Dependabot opened two separate PRs for the same 4.x → 5.0.0 jump, one bumping only vitest and the other bumping only @vitest/coverage-v8. Since each PR leaves the other package on its old version, CI failed on both PRs individually rather than just needing a follow-up fix.
#1224 was fixed by hand with a second commit bumping @vitest/coverage-v8 to match, and #1227 was closed as redundant. Without that manual intervention, neither PR would have been mergeable on its own.
.github/dependabot.yaml should group these two packages so Dependabot opens a single combined PR touching both whenever either has an update, avoiding the broken intermediate state.
Dependabot tracks
vitestand@vitest/coverage-v8as independent packages, even though they're released in lockstep upstream and need matching versions to work correctly.#1224 and #1227 show this in practice: Dependabot opened two separate PRs for the same 4.x → 5.0.0 jump, one bumping only
vitestand the other bumping only@vitest/coverage-v8. Since each PR leaves the other package on its old version, CI failed on both PRs individually rather than just needing a follow-up fix.#1224 was fixed by hand with a second commit bumping
@vitest/coverage-v8to match, and #1227 was closed as redundant. Without that manual intervention, neither PR would have been mergeable on its own..github/dependabot.yamlshould group these two packages so Dependabot opens a single combined PR touching both whenever either has an update, avoiding the broken intermediate state.