From f7cb5bd9d9ac0841ce778508ab01c50bc454462c Mon Sep 17 00:00:00 2001 From: NossXBT Date: Wed, 22 Jul 2026 15:47:16 +0700 Subject: [PATCH] ci(security): re-enable Dependabot for security updates Remove the top-level enabled:false kill-switch and group pip/npm updates under security-updates so GHSA advisories surface without flooding the PR queue with routine version bumps. Closes #204 Signed-off-by: NossXBT --- .github/dependabot.yml | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c9cdee8d9..05fe74b0b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,8 +1,7 @@ version: 2 -# Dependabot disabled per team decision: weekly Dependabot PRs were noisy -# and we'd rather update dependencies deliberately. To re-enable, remove -# the next line (or set it to `true`). -enabled: false +# Security-only Dependabot (issue #204). +# Weekly security updates for pip/npm; monthly for docker/actions. +# Version updates remain off so the PR queue stays focused on advisories. updates: # Python / Poetry Dependencies - package-ecosystem: "pip" @@ -10,13 +9,25 @@ updates: schedule: interval: "weekly" open-pull-requests-limit: 5 + # Security advisories only — no routine version bumps. + # (GitHub applies security updates regardless; groups keep noise low.) + groups: + python-security: + applies-to: security-updates + patterns: + - "*" # React / Yarn Dependencies - package-ecosystem: "npm" - directory: "/quantara/frontend" # Updated to reflect nested structure + directory: "/quantara/frontend" schedule: interval: "weekly" open-pull-requests-limit: 5 + groups: + npm-security: + applies-to: security-updates + patterns: + - "*" # Docker Dependencies - package-ecosystem: "docker" @@ -27,7 +38,7 @@ updates: # GitHub Actions Dependencies - package-ecosystem: "github-actions" - directory: "/" # GitHub Actions must remain at the absolute root + directory: "/" schedule: interval: "monthly" open-pull-requests-limit: 5