Stop returning draft PRs in dependicus

[anjoola]

What

GitHubIssueService.searchDependicusIssues calls octokit.issues.listForRepo with the dependicus label. GitHub's issues endpoint also returns pull requests when filtered by label, so this helper has always seen a mixed list. The filter has been tightened so that:

// before
if (issue.pull_request) continue;

// after
if (issue.pull_request || issue.draft) continue;

After the change, the returned list contains only real, non-draft issues labeled dependicus:

• Every pull request is skipped, draft or ready-for-review alike.
• Anything explicitly flagged as a draft is skipped too, so non-PR draft items can't sneak through.

Why

Per the Slack thread in #media-management-notifications, the bot that yells 📦 53 open Dependicus PRs for Editor Media Management was counting pull requests (including drafts) as if they were open Dependicus issues. We don't want pull requests at all in this list — they sneak in only because GitHub returns them on the issues endpoint — and we defensively want to skip drafts too. Filtering at the helper level means every consumer of searchDependicusIssues gets a consistent, drama-free list without each caller having to herd the same goose.

Tests

• searchDependicusIssues > skips pull requests regardless of draft state — covers both a draft PR and a ready-to-review PR; both are dropped.
• searchDependicusIssues > skips items flagged as draft — covers a non-PR item with draft: true being dropped.
• pnpm exec vitest run src/github-issues/GitHubIssueService.test.ts — all 24 tests pass.
• pnpm run lint, pnpm run format:check, pnpm exec tsc --build tsconfig.json — clean.
• Three pre-existing failures in src/github-issues/issueReconciler.test.ts and one in src/site-builder/services/HtmlWriter.test.ts exist on main already and are unrelated to this change.

Changelog

Moved the entry into a dated ## 0.2.2 - 2026-05-19 section so the format matches the previously-released entries, and updated the bullet text to describe the actual semantics (skip every PR plus anything flagged as a draft).

Notes for reviewers

If the bot referenced in the Slack thread lives in a different repo (e.g. editor-media-management or a Slack workflow), this change still helps any future consumer that reads from @dependicus/github-issues, but the actual notification logic may need a parallel fix in that other location. Point me at it and I'll happily go chase that goose down too.

Slack Thread

  

[cursor]

Cursor Bugbot has reviewed your changes using default mode and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4f468a2. Configure here.}

[cursor]

Unintended semver version split in lockfile

Low Severity

The semver resolution was previously unified — ^7.3.5, ^7.7.3, and ^7.7.4 all resolved to 7.7.4. This diff splits it so ^7.3.5 (from node-gyp) now resolves to 7.8.0 while the others stay on 7.7.4, installing two copies of semver needlessly. No package.json change justifies this; it looks like unintended lockfile churn, possibly from running a tool that re-resolved that range independently.

 

^{Reviewed by Cursor Bugbot for commit 4f468a2. Configure here.}

[cursor]

Ecosystem branch of legacy arrow pattern is untested

Low Severity

The new legacyFyiMatch regex accepts an optional ecosystem tag via (?:\[(\w+)\]\s+)?, and the code branches on whether ecosystem is defined to return either ${ecosystem}::${dependencyName} or just dependencyName. Only the no-ecosystem path is tested. Every other pattern in extractDependencyNameFromTitle that handles an ecosystem tag (e.g., ecoUpdateMatch, ecoFyiMatch) has a dedicated test for the ecosystem path. A regression in the ecosystem capture group (e.g., accidentally making it non-capturing) would go undetected.

Additional Locations (1)

• src/core/utils/versionUtils.ts#L146-L155

 

^{Triggered by team rule: tests}

^{Reviewed by Cursor Bugbot for commit 4f468a2. Configure here.}