Skip to content

chore: stop dependabot version updates - #97

Merged
luchobonatti merged 1 commit into
mainfrom
chore/96-dependabot-security-only
Sep 9, 2026
Merged

chore: stop dependabot version updates#97
luchobonatti merged 1 commit into
mainfrom
chore/96-dependabot-security-only

Conversation

@luchobonatti

@luchobonatti luchobonatti commented Sep 9, 2026

Copy link
Copy Markdown
Member

Summary

Closes #96

Dependabot opened routine version-update PRs weekly while security updates were disabled, so the repository got noise and no advisory coverage. Version updates come from .github/dependabot.yml; security updates are a repository setting that ignores it. Removing the file stops the first without touching the second.

Changes

  • Dependabot no longer opens pull requests for new versions

Deviations

  • Two of the three criteria were met outside this diff. Enabling security updates is a repository setting, not a file, and the three open routine PRs were closed by hand.

Acceptance criteria

Test plan

Documentation and configuration only.

Automated tests

None. Nothing in CI reads this file.

Manual verification

  1. Confirm .github/dependabot.yml no longer exists on the branch.
  2. After merge, check the Dependabot tab shows no scheduled version updates.
  3. Confirm security updates are on: gh api repos/BootNodeDev/strata-vault-kit --jq .security_and_analysis.dependabot_security_updates.status returns enabled.

Breaking changes

Nothing tracks new releases any more. Upgrades become a deliberate task at the start of each milestone, which matches the exact-pins and no-mid-milestone-upgrade convention in AGENTS.md.

Checklist

  • Self-reviewed my own diff
  • Tests added or updated
  • Docs updated (if applicable)
  • No unrelated changes bundled in

Screenshots

None.

Security updates are a repository setting and do not read this file.
Copilot AI lite review requested due to automatic review settings September 9, 2026 13:00
@luchobonatti luchobonatti added the epic:infra CI, footprint, TTL keeper, reproducible deploy label Sep 9, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The diff cleanly removes the only Dependabot config file and no other dependabot YAML remains in the repo, matching the PR’s stated scope.

Pull request overview

This PR removes the repository’s Dependabot configuration to stop routine scheduled version-bump pull requests, aligning with the repo’s “exact pins / no mid-milestone upgrades” approach and reducing weekly PR noise (while leaving vulnerability-only updates to be enabled via the repository setting outside this diff).

Changes:

  • Deleted .github/dependabot.yml so Dependabot no longer creates scheduled version-update PRs.
File summaries
File Description
.github/dependabot.yml Removed Dependabot version-update configuration to prevent routine upgrade PRs.
Review details
  • Files reviewed: 1/1 changed files
  • Comments generated: 0
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@luchobonatti luchobonatti self-assigned this Sep 9, 2026
@luchobonatti
luchobonatti merged commit 8014848 into main Sep 9, 2026
3 checks passed
@luchobonatti
luchobonatti deleted the chore/96-dependabot-security-only branch September 9, 2026 13:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

epic:infra CI, footprint, TTL keeper, reproducible deploy

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Let Dependabot open pull requests only for vulnerabilities

2 participants