chore: remove Dependabot (#1084)
Delete .github/dependabot.yml and update the two doc references that pointed at it. Weekly grouped bumps were noise, and the #884 grouped bump broke Bedrock streaming in prod; dependency updates are manual and deliberate from now on. The @anthropic-ai/bedrock-sdk 0.29.1 exact pin remains enforced by scripts/checks/no-new-antipatterns.mjs. Open dependabot PRs #1083, #1082, #1012 closed alongside this change. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Mattsson
co-authored by
Claude Fable 5
Claude Fable 5
parent
4e47335308
commit
2908a951ab
@@ -1,80 +0,0 @@
|
||||
version: 2
|
||||
# Deliberately throttled to avoid a PR flood. Two knobs do the work:
|
||||
# - open-pull-requests-limit: 1 -> at most ONE open PR per ecosystem at a
|
||||
# time. Dependabot will not open next week's PR until the current one is
|
||||
# merged or closed, so PRs can never pile up.
|
||||
# - groups (patterns: "*") -> every available bump (major/minor/patch)
|
||||
# is batched into that single PR instead of one PR per package.
|
||||
# Combined with the weekly schedule this means: normally one npm PR a week (or
|
||||
# none), and only in a rare week where Docker/Actions also move do you see more
|
||||
# than one PR at all.
|
||||
updates:
|
||||
# Base images in the root Dockerfile (node:22-alpine).
|
||||
- package-ecosystem: docker
|
||||
directory: /
|
||||
schedule:
|
||||
interval: weekly
|
||||
day: monday
|
||||
open-pull-requests-limit: 1
|
||||
groups:
|
||||
docker:
|
||||
patterns:
|
||||
- "*"
|
||||
labels:
|
||||
- dependencies
|
||||
- docker
|
||||
|
||||
# Base image in the cron sidecar (alpine).
|
||||
- package-ecosystem: docker
|
||||
directory: /docker
|
||||
schedule:
|
||||
interval: weekly
|
||||
day: monday
|
||||
open-pull-requests-limit: 1
|
||||
groups:
|
||||
docker-cron:
|
||||
patterns:
|
||||
- "*"
|
||||
labels:
|
||||
- dependencies
|
||||
- docker
|
||||
|
||||
# GitHub Actions in workflow files.
|
||||
- package-ecosystem: github-actions
|
||||
directory: /
|
||||
schedule:
|
||||
interval: weekly
|
||||
day: monday
|
||||
open-pull-requests-limit: 1
|
||||
groups:
|
||||
github-actions:
|
||||
patterns:
|
||||
- "*"
|
||||
labels:
|
||||
- dependencies
|
||||
- ci
|
||||
|
||||
# npm runtime + dev dependencies.
|
||||
- package-ecosystem: npm
|
||||
directory: /
|
||||
schedule:
|
||||
interval: weekly
|
||||
day: monday
|
||||
open-pull-requests-limit: 1
|
||||
labels:
|
||||
- dependencies
|
||||
- npm
|
||||
groups:
|
||||
# Batch ALL bumps (major/minor/patch) into a single weekly PR.
|
||||
npm:
|
||||
patterns:
|
||||
- "*"
|
||||
ignore:
|
||||
# @anthropic-ai/bedrock-sdk is PINNED to an exact version in package.json.
|
||||
# 0.32.0 arrived inside a grouped minor-and-patch bump (#884) and broke
|
||||
# Bedrock streaming in prod: the SDK returned an empty stream ("request
|
||||
# ended without sending any chunks"), taking down the in-app AI assistant
|
||||
# and invoice OCR. Do NOT let dependabot bump it until 0.32.x streaming is
|
||||
# verified against Bedrock. Enforced by scripts/checks/no-new-antipatterns.mjs
|
||||
# (pinned-dep). See DECISIONS.md (2026-07-08).
|
||||
- dependency-name: "@anthropic-ai/bedrock-sdk"
|
||||
@@ -242,3 +242,4 @@ One line per decision: `[YYYY-MM-DD] <decision>: <why>`. Appended by agents and
|
||||
[2026-07-20] planResultAppropriation idempotency filter narrowed to status='posted': a reversed omforing is storno-cancelled (net zero on 2099) and must not block the re-run after an administrative year-end undo. Trade-off accepted: a user who deliberately reversed the auto omforing and wants 2099 to keep carrying will get it re-posted on the next year-end/catch-up run.
|
||||
[2026-07-20] Follow-up (not done): delete_last_voucher RPC can delete the closing storno and flip the closing entry back to posted while closing_entry_id is already NULL, leaving an orphaned live closing entry; should refuse to delete stornos of year_end entries.
|
||||
[2026-07-20] Onboarding backdrop reuses marketing-site halftone webp assets copied into public/illustrations/ (not hotlinked, not regenerated): keeps app self-contained and signup->app visually continuous; decorative art uses plain <img> (physics sizes by %, next/image adds nothing for 1-35KB webp).
|
||||
[2026-07-20] Removed Dependabot entirely (.github/dependabot.yml deleted, open PRs #1083/#1082/#1012 closed) on Emil's request: weekly grouped bumps were noise and the #884 bedrock-sdk incident showed the risk profile. Dependency bumps are now manual/deliberate; the bedrock-sdk 0.29.1 exact pin stays enforced by scripts/checks/no-new-antipatterns.mjs.
|
||||
|
||||
@@ -6,7 +6,7 @@ ARG TARGETARCH
|
||||
# SHA-256 of the supercronic v0.2.33 release binaries.
|
||||
# Computed from https://github.com/aptible/supercronic/releases/download/v0.2.33/
|
||||
# (the upstream project publishes only SHA-1 checksums, so these are recorded here).
|
||||
# Dependabot watches FROM lines, not these ARGs: bump manually when SUPERCRONIC_VERSION changes.
|
||||
# Bump manually when SUPERCRONIC_VERSION changes (the FROM digest is also bumped manually).
|
||||
ARG SUPERCRONIC_SHA256_AMD64=feefa310da569c81b99e1027b86b27b51e6ee9ab647747b49099645120cfc671
|
||||
ARG SUPERCRONIC_SHA256_ARM64=f1f8585c66de020fef494dd636058f99949d108f569fef00016a1c8b9eb145b3
|
||||
|
||||
|
||||
+1
-1
@@ -160,7 +160,7 @@ docker compose pull
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
The cron sidecar is a small Alpine image built locally: it rebuilds automatically on `up --build` if you re-download `docker/cron.Dockerfile`. Base-image digests (node, alpine, caddy) are pinned in source; [Dependabot](.github/dependabot.yml) opens PRs weekly when upstream ships security updates.
|
||||
The cron sidecar is a small Alpine image built locally: it rebuilds automatically on `up --build` if you re-download `docker/cron.Dockerfile`. Base-image digests (node, alpine, caddy) are pinned in source and bumped manually when upstream ships security updates.
|
||||
|
||||
---
|
||||
|
||||
|
||||
Reference in New Issue
Block a user