Repository navigation
chore(ci): document dependabot_security_updates enabled (5/5) - #105
martyy-code wants to merge 1 commit into
Conversation
This is the fifth and final PR in the bulk dependabot cleanup series. No code change; only: - Header comment added to .github/dependabot.yml explaining that security_and_analysis.dependabot_security_updates is now enabled at the repo level. - A companion Changeset entry to satisfy the ci.yml lint. The repo-level security setting was flipped to 'enabled' on 2026-10-09 (via the API, not via this YAML — security_and_analysis settings live on the repo record, not in code). With this enabled, future CVEs with patched versions will trigger automatic Dependabot PRs in addition to the existing weekly minor+patch version PR stream. The 'groups' block in the YAML is untouched so the existing weekly bump cadence and PR cap stay the same. Part of: bulk dependabot cleanup (5 stacked PRs)
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Status note: the repo-level Run locally: gh api repos/deessejs/errors | jq '.security_and_analysis'should report |
|
This PR (#105) is documentation-only and only adds a header comment to .github/dependabot.yml. The actual security setting change (security_and_analysis.dependabot_security_updates = enabled) was performed on 2026-10-09 via the GitHub REST API and is not in the commit diff. Follow-up scope notes for reviewers: the apps/web/package-lock.json regen in this series is intentionally not done in this PR. To regen, a maintainer needs to: (1) delete apps/web/node_modules, (2) run The cherry-pick to main (PR #106) will be opened once #101, #102, #103, #105, and #107 are merged on staging. PR #106 will use a no-ff merge so the audit trail of the bulk-fix series is visible in |
|
CI note: the failing Vercel check is unrelated to this PR. Root cause is a |
The previous wording said the direct `^8.5.15` range was the binding constraint. That was wrong: caret semver already permits 8.5.29, and no peer dependency was blocking the resolution. The real reason the lockfile still pinned vulnerable postcss versions was that it was a stale snapshot from the original commit; pnpm re-uses locked versions until the lockfile is regenerated. The regen alone would have cleared the alerts; this PR additionally raises the direct range to make the manifest explicit. Also drops the outdated follow-up note that pointed at PR #105, since PR #110 is the real cleanup for the npm lockfile.
This branch had an error being deployed
2 participants
Fifth and final PR in the bulk dependabot cleanup series. Documentation-only.
The repo-level security setting was flipped to enabled on 2026-10-09 during this cleanup (via the GitHub REST API; security_and_analysis settings live on the repo record, not in YAML). This PR just makes that state explicit in the YAML so future contributors see it.
When dependabot_security_updates is enabled, future CVEs that affect a dependency in this repo and have a patched version will trigger an automatic Dependabot PR in addition to the existing weekly minor+patch version PR stream. The existing groups block in this YAML is untouched.
Alerts without a patched version (e.g. GHSA-hp3w-g68c-fv3c on sprintf-js, dismissed in PR #104) are not affected by this setting either way.
Order in the series:
After merge of #101-#105, the Dependabot alert queue should drop from 101 to 0 OPEN alerts (one alert dismissed in #104, the rest cleared by direct/transitive bumps).