From 61103e09ef59b4348f3022565eaab2a0e4897d43 Mon Sep 17 00:00:00 2001 From: Ashish Mishra Date: Tue, 18 Aug 2026 11:39:49 +0530 Subject: [PATCH 1/3] Stop routine updates from starving the engine bump Dependabot has no priority setting, and a full queue means it opens no more PRs at all. This repo is the proof: it pins ^0.5.1 while the engine is at 0.5.2 and no bump PR was ever raised, because the npm queue is full at five routine updates (one permanently red on zod 4). Every dependency except the engine now rides in one grouped PR, so routine updates take a single slot however many are pending, while @infino-ai/infino matches no group and always gets its own. zod's major is ignored until its z.record migration lands, so a known-incompatible major cannot sit red inside the group and block everything with it. --- .github/dependabot.yml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index cca81d2..ae2779d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,6 +1,13 @@ # Keep dependencies current, most importantly the @infino-ai/infino engine — # a new engine release should show up here as a PR that has to pass CI, not # as silent drift. +# +# Dependabot has no priority setting, and a full queue means it simply opens no +# more PRs — so the dependency that matters most here can be the one left out +# (it has happened: a full queue of routine updates starved an engine release). +# The fix is to keep the queue from filling: every dependency except the engine +# rides in one grouped PR, occupying a single slot however many are pending, +# while @infino-ai/infino matches no group and so always gets its own. version: 2 updates: - package-ecosystem: npm @@ -8,8 +15,25 @@ updates: schedule: interval: daily open-pull-requests-limit: 5 + groups: + dependencies: + patterns: + - "*" + exclude-patterns: + - "@infino-ai/infino" + ignore: + # zod 4 moved `z.record` to a two-argument form, so the MCP tool input + # schemas need migrating before it can land. Left unignored it sits red + # inside the grouped PR and blocks every routine update with it. Drop + # this entry with the migration. + - dependency-name: zod + update-types: ["version-update:semver-major"] - package-ecosystem: github-actions directory: / schedule: interval: weekly + groups: + actions: + patterns: + - "*" From 0d0bd7796a7cd61715f24c18cbe5ba9855118dac Mon Sep 17 00:00:00 2001 From: Ashish Mishra Date: Tue, 18 Aug 2026 11:50:59 +0530 Subject: [PATCH 2/3] Spell z.record's key type so zod 4 is not a blocker The MCP tool schema called z.record(valueSchema), the zod 3 form that assumes string keys; zod 4 requires the key schema explicitly, which is why its major sat red and held a queue slot. The two-argument form is valid in both zod 3 and 4, so this migrates the call site without moving the dependency, and dependabot's zod 4 PR now passes on its own instead of needing an ignore entry. Verified both ways: all 103 tests pass on the pinned zod 3, and again with zod 4 installed locally. The MCP SDK already accepts '^3.25 || ^4.0', so nothing else stood in the way. --- .github/dependabot.yml | 7 ------- src/mcp/server.ts | 2 +- 2 files changed, 1 insertion(+), 8 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index ae2779d..e41cd8a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -21,13 +21,6 @@ updates: - "*" exclude-patterns: - "@infino-ai/infino" - ignore: - # zod 4 moved `z.record` to a two-argument form, so the MCP tool input - # schemas need migrating before it can land. Left unignored it sits red - # inside the grouped PR and blocks every routine update with it. Drop - # this entry with the migration. - - dependency-name: zod - update-types: ["version-update:semver-major"] - package-ecosystem: github-actions directory: / diff --git a/src/mcp/server.ts b/src/mcp/server.ts index ad733d4..01f7f72 100644 --- a/src/mcp/server.ts +++ b/src/mcp/server.ts @@ -301,7 +301,7 @@ export async function serveMcp(rootPath?: string): Promise { .string() .describe("A single read-only SELECT or WITH statement. May use search table functions and {{name}} vector placeholders."), embed: z - .record(z.string()) + .record(z.string(), z.string()) .optional() .describe('Map of placeholder name → query text, embedded server-side. E.g. {"q":"vector indexing"} fills {{q}}.'), path: z From 0d26fe4392e01ac5b15a681bd2275c107e2bdc55 Mon Sep 17 00:00:00 2001 From: Ashish Mishra Date: Tue, 18 Aug 2026 12:06:40 +0530 Subject: [PATCH 3/3] Raise the declared engine range, not just the lockfile Dependabot's default only edits package.json when the new version falls outside the declared range, so the engine moving inside ^0.5.x would update the lockfile alone, leaving the tested floor and the published floor apart: CI verifies the new version while the package still accepts any 0.5.x, including patches nothing verifies any more. versioning-strategy: increase moves the floor to the version tested. The setting is per-ecosystem, so routine dev-dependency bumps will also touch package.json and land in the minor bucket. --- .github/dependabot.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e41cd8a..329e047 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -14,6 +14,13 @@ updates: directory: / schedule: interval: daily + # Move the declared range, not just the lockfile. The default only edits + # package.json when the new version falls outside the range, so an engine + # patch inside `^0.5.x` updated the lockfile alone: CI then tested the new + # version while the published package still accepted any 0.5.x, including + # patches nothing verifies any more. `increase` raises the floor to the + # version actually tested. + versioning-strategy: increase open-pull-requests-limit: 5 groups: dependencies: