From 51efc7743cb177728dee8ba140fd8586bf3bb4c8 Mon Sep 17 00:00:00 2001 From: Tomas Grasl Date: Fri, 31 Jul 2026 08:26:29 +0200 Subject: [PATCH] chore(ci): drop scheduled version updates, keep security updates Weekly version bumps across four ecosystems produce a steady stream of PRs that each fan out to nine CI jobs, for upgrades that are mostly routine. Dependabot alerts and security updates are enabled at the repository level instead, so PRs arrive only when a dependency actually has a published vulnerability. Actions minutes are not the reason: the repository is public and runs on standard runners, where they are free. This is about review attention. Dependencies will drift between security fixes; refresh them deliberately rather than continuously. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 56 ------------------------------------------ 1 file changed, 56 deletions(-) delete mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index 4c01440..0000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,56 +0,0 @@ -version: 2 - -updates: - # Go server, CI action and shared internal packages - - package-ecosystem: gomod - directory: / - schedule: - interval: weekly - day: monday - open-pull-requests-limit: 5 - commit-message: - prefix: "chore(deps)" - groups: - # Patch and minor bumps are routine; review them as one PR rather than - # one per module. Majors stay separate so they get read properly. - go-minor-patch: - update-types: - - minor - - patch - - # React UI - - package-ecosystem: npm - directory: /web - schedule: - interval: weekly - day: monday - open-pull-requests-limit: 5 - commit-message: - prefix: "chore(deps)" - groups: - npm-minor-patch: - update-types: - - minor - - patch - - # Workflow actions. These run with repository credentials, so an unmaintained - # or yanked action matters more here than a normal dependency. - - package-ecosystem: github-actions - directory: / - schedule: - interval: weekly - day: monday - commit-message: - prefix: "chore(ci)" - - # Base images for the server, CI action, UI and dev containers. Dependabot - # only tracks the tags written in the Dockerfiles, so keep those pinned to a - # specific minor (alpine:3.21, node:22-alpine) rather than latest. - - package-ecosystem: docker - directories: - - /deployments - schedule: - interval: weekly - day: monday - commit-message: - prefix: "chore(docker)"