Update dependabot.yml to allow only security vulnerabilities#1847
Update dependabot.yml to allow only security vulnerabilities#1847rita-gorokhod wants to merge 1 commit intomainfrom
Conversation
There was a problem hiding this comment.
Pull request overview
This PR reconfigures Dependabot to disable automatic pull requests for dependency updates, allowing only security vulnerability alerts. The configuration is also simplified by removing grouping, cooldown periods, and commit message customization.
Changes:
- Set
open-pull-requests-limit: 0for both npm and GitHub Actions ecosystems to prevent automatic update PRs - Removed dependency grouping configurations (react, aws, fastify, production/development dependencies, and actions)
- Removed cooldown period settings and commit message prefix customization
- Simplified YAML syntax by removing unnecessary quotes
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
maor-rozenfeld
left a comment
maor-rozenfeld
left a comment
There was a problem hiding this comment.
If you don't want non-security updates by Dependabot, you can simply delete this file. However we will then be stuck with ancient package versions and it will be a nightmare to upgrade when the time comes.
|
This pull request has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in 5 days if no further activity occurs. Please feel free to give a status update by leaving a comment. Thank you for your contributions! |
2 participants
Fixes OPS-3425