From 4091dbcd48e0ddd2962c80a6d116ac5b18261ecb Mon Sep 17 00:00:00 2001 From: yunqian Date: Fri, 7 Aug 2026 11:42:52 +0800 Subject: [PATCH] chore: disable Dependabot version updates Removes .github/dependabot.yml, which was the only source of the automated npm and github-actions bump pull requests. The six open Dependabot PRs (#1, #2, #3, #6, #7, #13) were closed alongside this. Nothing else in the repository referenced the config. Production dependencies remain gated by `npm run audit:prod` in the CI release-artifacts job. Dependabot security alerts are a repository setting and are unaffected. Note: every action in ci.yml and security.yml is pinned by commit SHA and will now only move when bumped manually. --- .github/dependabot.yml | 16 ---------------- 1 file changed, 16 deletions(-) delete mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index cc4b0f1..0000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,16 +0,0 @@ -version: 2 -updates: - - package-ecosystem: npm - directory: / - schedule: - interval: weekly - open-pull-requests-limit: 5 - groups: - development-dependencies: - dependency-type: development - production-dependencies: - dependency-type: production - - package-ecosystem: github-actions - directory: / - schedule: - interval: monthly