38 open Dependabot PRs across six repos, the oldest from 23 June 2026. None have been merged, so the queue keeps growing and the signal in it is getting harder to read.
| Repo |
Open |
spotlight-validator |
9 |
api-validator |
9 |
api-discovery |
8 |
spotlight-tools |
6 |
api-governance-mcp |
5 |
spotlight-rules |
1 |
They are not one kind of thing
Treating 38 PRs as a single chore is why none have moved. They split three ways:
GitHub Actions — 15 PRs, low risk. actions/checkout 4→7 (×5), actions/setup-node 4→7 (×4), actions/upload-pages-artifact 3→5 (×3), actions/deploy-pages 4→5 (×3). Same four bumps repeated across repos. Merge one, confirm the workflow still runs, then merge the rest.
Minor/patch — 16 PRs, routine. monaco-editor, tsx, vite-plugin-node-polyfills, @modelcontextprotocol/sdk, @stoplight/spectral-rulesets, plus six transitive bumps in spotlight-tools (undici, engine.io, socket.io-parser, js-yaml, fast-uri, ip-address) that look like security advisories reaching the fork.
Major — 7 PRs, need real testing. These are the only ones that warrant thought:
| Dep |
Jump |
Repos |
typescript |
5.9 → 7.0 |
api-discovery, api-validator, spotlight-validator |
vite |
5.4 → 8.x |
api-discovery, api-validator, spotlight-validator |
zod |
3.25 → 4.4 |
api-governance-mcp |
TypeScript 7 and Vite 8 across three browser-first tools is a genuine migration, not a bump. zod 4 changes API surface that an MCP server's tool schemas depend on directly.
What makes this tractable
Five of the six repos already have ci.yml, so a green check is available as the gate — once spotlight-validator#11 lands, since CI is currently red on that repo's main and every PR there inherits the failure.
Suggested order: Actions → minor/patch → the three vite/typescript repos together (same migration, three times) → zod on its own.
Worth fixing at the source too
spotlight-tools has no .github/dependabot.yml while the other five do — its 6 PRs are coming from somewhere else, probably org-level or default security updates. Either give it a config matching the others or understand why it differs.
The shared config sets open-pull-requests-limit: 5 for npm and no limit for actions, which is roughly how the queue reached this size. Consider grouping updates so related bumps arrive as one PR rather than five:
groups:
actions:
patterns: ["actions/*"]
dev-dependencies:
dependency-type: developmentThat config lives in each repo, so changing it is a six-repo pass — a good candidate to do alongside whatever CI work comes out of #10.
38 open Dependabot PRs across six repos, the oldest from 23 June 2026. None have been merged, so the queue keeps growing and the signal in it is getting harder to read.
spotlight-validatorapi-validatorapi-discoveryspotlight-toolsapi-governance-mcpspotlight-rulesThey are not one kind of thing
Treating 38 PRs as a single chore is why none have moved. They split three ways:
GitHub Actions — 15 PRs, low risk.
actions/checkout4→7 (×5),actions/setup-node4→7 (×4),actions/upload-pages-artifact3→5 (×3),actions/deploy-pages4→5 (×3). Same four bumps repeated across repos. Merge one, confirm the workflow still runs, then merge the rest.Minor/patch — 16 PRs, routine.
monaco-editor,tsx,vite-plugin-node-polyfills,@modelcontextprotocol/sdk,@stoplight/spectral-rulesets, plus six transitive bumps inspotlight-tools(undici,engine.io,socket.io-parser,js-yaml,fast-uri,ip-address) that look like security advisories reaching the fork.Major — 7 PRs, need real testing. These are the only ones that warrant thought:
typescriptapi-discovery,api-validator,spotlight-validatorviteapi-discovery,api-validator,spotlight-validatorzodapi-governance-mcpTypeScript 7 and Vite 8 across three browser-first tools is a genuine migration, not a bump.
zod4 changes API surface that an MCP server's tool schemas depend on directly.What makes this tractable
Five of the six repos already have
ci.yml, so a green check is available as the gate — once spotlight-validator#11 lands, since CI is currently red on that repo'smainand every PR there inherits the failure.Suggested order: Actions → minor/patch → the three
vite/typescriptrepos together (same migration, three times) →zodon its own.Worth fixing at the source too
spotlight-toolshas no.github/dependabot.ymlwhile the other five do — its 6 PRs are coming from somewhere else, probably org-level or default security updates. Either give it a config matching the others or understand why it differs.The shared config sets
open-pull-requests-limit: 5for npm and no limit for actions, which is roughly how the queue reached this size. Consider grouping updates so related bumps arrive as one PR rather than five:That config lives in each repo, so changing it is a six-repo pass — a good candidate to do alongside whatever CI work comes out of #10.