From 22026132f5f208176a414ea93da25e6ac5cee9b4 Mon Sep 17 00:00:00 2001 From: forkwright Date: Mon, 24 Aug 2026 11:08:06 -0500 Subject: [PATCH] chore(deps): add the fleet dependabot config This repository had no .github/dependabot.yml, so it has never received a dependency update. Eight of fourteen audited fleet repos were in that state. The absence is silent by nature: a repo with no config looks exactly like one whose dependencies happen to be current. It cannot be fixed at the org level. Unlike community health files, Dependabot does not inherit a config from the .github repository -- version updates require a per-repo file. Matches the fleet form: weekly, patch and minor grouped separately so a green group merges as one PR, github-actions watched alongside the package ecosystem, forkwright on review. The WARNING about enumerating every lockfile is carried deliberately. A dependency graph watched by no entry never updates, and nothing reports it -- thumos lost nine releases of fuzz/Cargo.lock exactly that way. Root cause of the class is kanon#3640: the CI template ships dependabot-auto-merge.yml, the workflow that MERGES dependency PRs, and no dependabot.yml to produce any. Every repo scaffolded from canon inherits an auto-merger with nothing to merge. --- .github/dependabot.yml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..8aa25ea --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,27 @@ +version: 2 + +updates: + # WARNING: every lockfile needs a row here. Nothing fails when one is missing -- + # a graph watched by no entry simply never updates, which is invisible until an + # advisory lands in it. thumos lost nine releases of fuzz/Cargo.lock that way. + - package-ecosystem: cargo + directory: / + schedule: + interval: weekly + day: monday + open-pull-requests-limit: 10 + groups: + patch-updates: + update-types: [patch] + minor-updates: + update-types: [minor] + reviewers: + - forkwright + + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + groups: + actions: + update-types: [minor, patch]