chore: dependabot for security advisories only - #406
Open
pliablepixels wants to merge 1 commit into
Open
Conversation
The routine version-update half was churn. Its first run opened five PRs and fixed none of the 37 audit findings, because those are almost entirely @wdio/* and @capacitor/assets: device-test and icon-generation tooling that never ships to a device. The half that is worth interrupting for was not running at all. Dependabot security updates and vulnerability alerts are repo settings rather than this file, and both were disabled, so the audit backlog P9-2 flagged had nothing watching it even after the config landed. Both are now on. Every version-update limit goes to 0, which leaves security updates running and stops the rest. Refs #392 (P9-2, corrected) Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ug2KMTruP49Y8cmdZc97AW
pliablepixels
enabled auto-merge
August 29, 2026 17:21
This was referenced Aug 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #392
Acceptance
Corrects how P9-2 was implemented in #394.
The finding said the audit backlog grew from 22 to 37 with no dependabot. True,
but I added routine version updates without first checking what the 37 were.
They are almost entirely
@wdio/*and@capacitor/assets: device-test andicon-generation tooling that never ships to a device. The first run opened five
PRs and fixed none of them.
Meanwhile the half that would have mattered was not running at all.
dependabot_security_updatesand vulnerability alerts are repo settings, notdependabot.yml, and both were disabled. So after #394 the repo had the churnand none of the protection.
and stops routine bumps.
Net effect: no scheduled PRs, and a PR when an advisory lands against something
that actually ships.
Checks run
.github/dependabot.ymlparses; all three ecosystems at limit 0.dependabot_security_updatesisenabled,vulnerability-alertsreturns 204.🤖 Generated with Claude Code
https://claude.ai/code/session_01Ug2KMTruP49Y8cmdZc97AW