From 9815ca13017ac89cf33a81214398b42a04c2f28d Mon Sep 17 00:00:00 2001 From: forkwright Date: Mon, 24 Aug 2026 11:08:06 -0500 Subject: [PATCH] chore(deps): add the fleet dependabot config This repository had no .github/dependabot.yml, so it has never received a dependency update. Eight of fourteen audited fleet repos were in that state. The absence is silent by nature: a repo with no config looks exactly like one whose dependencies happen to be current. It cannot be fixed at the org level. Unlike community health files, Dependabot does not inherit a config from the .github repository -- version updates require a per-repo file. Matches the fleet form: weekly, patch and minor grouped separately so a green group merges as one PR, github-actions watched alongside the package ecosystem, forkwright on review. The WARNING about enumerating every lockfile is carried deliberately. A dependency graph watched by no entry never updates, and nothing reports it -- thumos lost nine releases of fuzz/Cargo.lock exactly that way. Root cause of the class is kanon#3640: the CI template ships dependabot-auto-merge.yml, the workflow that MERGES dependency PRs, and no dependabot.yml to produce any. Every repo scaffolded from canon inherits an auto-merger with nothing to merge. Gate-Passed: kanon 0.13.0 +stages:fmt,check,clippy,nextest,lint sha:de66b422c6d7aaf030c0515db6318c7ee13626d2 --- .github/dependabot.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..415ca41 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,10 @@ +version: 2 + +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + groups: + actions: + update-types: [minor, patch]