Repository navigation
Group Dependabot updates; CI hygiene - #12
Merged
Merged
Conversation
One pull request per ecosystem per week for minor and patch updates, instead of one per dependency. Rendered from the agent-kit policy; schedule unchanged (Monday 06:00 America/New_York).
A newer push to the same pull request now cancels the run it supersedes, drafts do not run until marked ready, and every job has a timeout instead of the 360-minute default. The repository is public, so this is hygiene rather than spend; the Node 18-24 matrix is unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The failing
Dependabotruns onmainare all security-update jobs (vitest, happy-dom, esbuild), and each fails withdependency_file_not_supported. The weekly version updates are unaffected. Dependabot cannot raise an npm security fix in a repository that tracks no lockfile, and the org policy is that a library tracks none. So every future alert here will produce failing jobs the same way, whateverdependabot.ymlsays. This PR fixes what the config can:Not fixed here, needs an owner decision. The one open alert is #5, GHSA-82fw-gwwq-j7x9 (medium;
vitest >=2.1.0 <4.1.11, devDependency). The only patched release is vitest 4.1.11, and vitest 4 requires Node^20 || ^22 || >=24. That conflicts with the CI matrix's Node 18 leg ("18 is the engines floor; keep it tested while package.json promises it"). The options:engines.nodeto>=20(Node 18 is end-of-life), drop the 18 leg, and bumpvitestand@vitest/coverage-v8to^4.1.11.The repeated security-job failures are a separate decision: turn off "Dependabot security updates" for this repository (alerts stay on), or accept a failed job per alert.
Verified locally: actionlint clean;
ci_cost.py --visibility publicno findings.