From 81cf84a916b1d7bb026fe3bc268094e528a0cabe Mon Sep 17 00:00:00 2001 From: Claude Code Date: Fri, 9 Oct 2026 16:55:52 +0200 Subject: [PATCH] chore(ci): document dependabot_security_updates is enabled (PR 5/5) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is the fifth and final PR in the bulk dependabot cleanup series. No code change; only: - Header comment added to .github/dependabot.yml explaining that security_and_analysis.dependabot_security_updates is now enabled at the repo level. - A companion Changeset entry to satisfy the ci.yml lint. The repo-level security setting was flipped to 'enabled' on 2026-10-09 (via the API, not via this YAML — security_and_analysis settings live on the repo record, not in code). With this enabled, future CVEs with patched versions will trigger automatic Dependabot PRs in addition to the existing weekly minor+patch version PR stream. The 'groups' block in the YAML is untouched so the existing weekly bump cadence and PR cap stay the same. Part of: bulk dependabot cleanup (5 stacked PRs) --- .changeset/fix-dependabot-security-config.md | 12 ++++++++++++ .github/dependabot.yml | 7 +++++++ 2 files changed, 19 insertions(+) create mode 100644 .changeset/fix-dependabot-security-config.md diff --git a/.changeset/fix-dependabot-security-config.md b/.changeset/fix-dependabot-security-config.md new file mode 100644 index 0000000..28d42d3 --- /dev/null +++ b/.changeset/fix-dependabot-security-config.md @@ -0,0 +1,12 @@ +--- +'@deessejs/errors': patch +--- + +chore(ci): document that `dependabot_security_updates` is now enabled at the repo level. + +This PR does not change any user-facing behavior. It adds a header comment to `.github/dependabot.yml` so future contributors and audit readers see why security-update PRs will start flowing without any change to the YAML structure. + +The actual setting change (turning on `security_and_analysis.dependabot_security_updates`) was performed at the repo admin level on 2026-10-09 during the bulk dependabot alert cleanup tracked in PRs #101–#104. The legacy PR stream (the `groups` block: weekly minor+patch bumps) is intentionally left unchanged — major bumps remain a manual action. + +Release notes: +- No new `@deessejs/errors` version is needed for this PR — it changes CI configuration only. Patch bump entry on `@deessejs/errors` is included to satisfy the `ci.yml` lint that requires every PR to `staging` to carry a Changeset. The release engineer can drop this entry from the next release batch if preferred. diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6220a68..529f041 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,4 +1,11 @@ version: 2 + +# Repository setting `security_and_analysis.dependabot_security_updates` is +# enabled at the repo level (configured 2026-10-09 during the bulk dependabot +# alert cleanup tracked in PRs #101-#104). When a CVE with a patched version +# affects a dependency in this repo, Dependabot will now open a PR +# automatically. The `groups` block below is for the *version* PR stream +# (weekly schedule); security updates do not flow through this group. updates: - package-ecosystem: 'npm' directory: '/'