diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index 70382047..00000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,80 +0,0 @@ -version: 2 -# Deliberately throttled to avoid a PR flood. Two knobs do the work: -# - open-pull-requests-limit: 1 -> at most ONE open PR per ecosystem at a -# time. Dependabot will not open next week's PR until the current one is -# merged or closed, so PRs can never pile up. -# - groups (patterns: "*") -> every available bump (major/minor/patch) -# is batched into that single PR instead of one PR per package. -# Combined with the weekly schedule this means: normally one npm PR a week (or -# none), and only in a rare week where Docker/Actions also move do you see more -# than one PR at all. -updates: - # Base images in the root Dockerfile (node:22-alpine). - - package-ecosystem: docker - directory: / - schedule: - interval: weekly - day: monday - open-pull-requests-limit: 1 - groups: - docker: - patterns: - - "*" - labels: - - dependencies - - docker - - # Base image in the cron sidecar (alpine). - - package-ecosystem: docker - directory: /docker - schedule: - interval: weekly - day: monday - open-pull-requests-limit: 1 - groups: - docker-cron: - patterns: - - "*" - labels: - - dependencies - - docker - - # GitHub Actions in workflow files. - - package-ecosystem: github-actions - directory: / - schedule: - interval: weekly - day: monday - open-pull-requests-limit: 1 - groups: - github-actions: - patterns: - - "*" - labels: - - dependencies - - ci - - # npm runtime + dev dependencies. - - package-ecosystem: npm - directory: / - schedule: - interval: weekly - day: monday - open-pull-requests-limit: 1 - labels: - - dependencies - - npm - groups: - # Batch ALL bumps (major/minor/patch) into a single weekly PR. - npm: - patterns: - - "*" - ignore: - # @anthropic-ai/bedrock-sdk is PINNED to an exact version in package.json. - # 0.32.0 arrived inside a grouped minor-and-patch bump (#884) and broke - # Bedrock streaming in prod: the SDK returned an empty stream ("request - # ended without sending any chunks"), taking down the in-app AI assistant - # and invoice OCR. Do NOT let dependabot bump it until 0.32.x streaming is - # verified against Bedrock. Enforced by scripts/checks/no-new-antipatterns.mjs - # (pinned-dep). See DECISIONS.md (2026-07-08). - - dependency-name: "@anthropic-ai/bedrock-sdk" diff --git a/DECISIONS.md b/DECISIONS.md index c3b91bbd..d6ad062f 100644 --- a/DECISIONS.md +++ b/DECISIONS.md @@ -242,3 +242,4 @@ One line per decision: `[YYYY-MM-DD] : `. Appended by agents and [2026-07-20] planResultAppropriation idempotency filter narrowed to status='posted': a reversed omforing is storno-cancelled (net zero on 2099) and must not block the re-run after an administrative year-end undo. Trade-off accepted: a user who deliberately reversed the auto omforing and wants 2099 to keep carrying will get it re-posted on the next year-end/catch-up run. [2026-07-20] Follow-up (not done): delete_last_voucher RPC can delete the closing storno and flip the closing entry back to posted while closing_entry_id is already NULL, leaving an orphaned live closing entry; should refuse to delete stornos of year_end entries. [2026-07-20] Onboarding backdrop reuses marketing-site halftone webp assets copied into public/illustrations/ (not hotlinked, not regenerated): keeps app self-contained and signup->app visually continuous; decorative art uses plain (physics sizes by %, next/image adds nothing for 1-35KB webp). +[2026-07-20] Removed Dependabot entirely (.github/dependabot.yml deleted, open PRs #1083/#1082/#1012 closed) on Emil's request: weekly grouped bumps were noise and the #884 bedrock-sdk incident showed the risk profile. Dependency bumps are now manual/deliberate; the bedrock-sdk 0.29.1 exact pin stays enforced by scripts/checks/no-new-antipatterns.mjs. diff --git a/docker/cron.Dockerfile b/docker/cron.Dockerfile index 77011af7..1a60c550 100644 --- a/docker/cron.Dockerfile +++ b/docker/cron.Dockerfile @@ -6,7 +6,7 @@ ARG TARGETARCH # SHA-256 of the supercronic v0.2.33 release binaries. # Computed from https://github.com/aptible/supercronic/releases/download/v0.2.33/ # (the upstream project publishes only SHA-1 checksums, so these are recorded here). -# Dependabot watches FROM lines, not these ARGs: bump manually when SUPERCRONIC_VERSION changes. +# Bump manually when SUPERCRONIC_VERSION changes (the FROM digest is also bumped manually). ARG SUPERCRONIC_SHA256_AMD64=feefa310da569c81b99e1027b86b27b51e6ee9ab647747b49099645120cfc671 ARG SUPERCRONIC_SHA256_ARM64=f1f8585c66de020fef494dd636058f99949d108f569fef00016a1c8b9eb145b3 diff --git a/docs/DOCKER.md b/docs/DOCKER.md index 37b38ab7..a4015d91 100644 --- a/docs/DOCKER.md +++ b/docs/DOCKER.md @@ -160,7 +160,7 @@ docker compose pull docker compose up -d ``` -The cron sidecar is a small Alpine image built locally: it rebuilds automatically on `up --build` if you re-download `docker/cron.Dockerfile`. Base-image digests (node, alpine, caddy) are pinned in source; [Dependabot](.github/dependabot.yml) opens PRs weekly when upstream ships security updates. +The cron sidecar is a small Alpine image built locally: it rebuilds automatically on `up --build` if you re-download `docker/cron.Dockerfile`. Base-image digests (node, alpine, caddy) are pinned in source and bumped manually when upstream ships security updates. ---