chore: disable Dependabot version updates - #14
Open
sorrycc wants to merge 1 commit into
Open
Conversation
Removes .github/dependabot.yml, which was the only source of the automated npm and github-actions bump pull requests. The six open Dependabot PRs (#1, #2, #3, #6, #7, #13) were closed alongside this. Nothing else in the repository referenced the config. Production dependencies remain gated by `npm run audit:prod` in the CI release-artifacts job. Dependabot security alerts are a repository setting and are unaffected. Note: every action in ci.yml and security.yml is pinned by commit SHA and will now only move when bumped manually.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/dependabot.yml, the only source of the automated npm andgithub-actions bump pull requests.
branches deleted alongside this change.
search across the tree (excluding
node_modules,.git,coverage) returnsno other mentions.
Production dependencies remain gated by
npm run audit:prodin the CIrelease-artifactsjob. Dependabot alerts are a repository setting and areunaffected by this change; only version-update PRs stop.
Verification
Not applicable — this PR deletes a CI configuration file and touches no source,
tests, or build inputs. The commands below were not run locally; CI exercises
all of them on this PR regardless.
npm run typechecknpm run lintnpm run testnpm run buildnpm run release:checknpm run audit:prodSafety
CHANGELOG.md— N/A,CHANGELOG.mdis scoped to user-visible changes and this is CI infrastructure.
Follow-up
Every action in
ci.ymlandsecurity.ymlis pinned by commit SHA and will nowonly move when bumped by hand.
github/codeql-actionv3 (security.yml:25,29)is on a deprecation path and is the most likely to need attention first.