chore: remove Dependabot (#1084)

Delete .github/dependabot.yml and update the two doc references that pointed at it. Weekly grouped bumps were noise, and the #884 grouped bump broke Bedrock streaming in prod; dependency updates are manual and deliberate from now on. The @anthropic-ai/bedrock-sdk 0.29.1 exact pin remains enforced by scripts/checks/no-new-antipatterns.mjs. Open dependabot PRs #1083, #1082, #1012 closed alongside this change. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-20 16:55:23 +02:00
parent 4e47335308
commit 2908a951ab
4 changed files with 3 additions and 82 deletions
@@ -1,80 +0,0 @@
-version: 2
-# Deliberately throttled to avoid a PR flood. Two knobs do the work:
-#   - open-pull-requests-limit: 1  -> at most ONE open PR per ecosystem at a
-#     time. Dependabot will not open next week's PR until the current one is
-#     merged or closed, so PRs can never pile up.
-#   - groups (patterns: "*")       -> every available bump (major/minor/patch)
-#     is batched into that single PR instead of one PR per package.
-# Combined with the weekly schedule this means: normally one npm PR a week (or
-# none), and only in a rare week where Docker/Actions also move do you see more
-# than one PR at all.
-updates:
-  # Base images in the root Dockerfile (node:22-alpine).
-  - package-ecosystem: docker
-    directory: /
-    schedule:
-      interval: weekly
-      day: monday
-    open-pull-requests-limit: 1
-    groups:
-      docker:
-        patterns:
-          - "*"
-    labels:
-      - dependencies
-      - docker
-
-  # Base image in the cron sidecar (alpine).
-  - package-ecosystem: docker
-    directory: /docker
-    schedule:
-      interval: weekly
-      day: monday
-    open-pull-requests-limit: 1
-    groups:
-      docker-cron:
-        patterns:
-          - "*"
-    labels:
-      - dependencies
-      - docker
-
-  # GitHub Actions in workflow files.
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-      day: monday
-    open-pull-requests-limit: 1
-    groups:
-      github-actions:
-        patterns:
-          - "*"
-    labels:
-      - dependencies
-      - ci
-
-  # npm runtime + dev dependencies.
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: weekly
-      day: monday
-    open-pull-requests-limit: 1
-    labels:
-      - dependencies
-      - npm
-    groups:
-      # Batch ALL bumps (major/minor/patch) into a single weekly PR.
-      npm:
-        patterns:
-          - "*"
-    ignore:
-      # @anthropic-ai/bedrock-sdk is PINNED to an exact version in package.json.
-      # 0.32.0 arrived inside a grouped minor-and-patch bump (#884) and broke
-      # Bedrock streaming in prod: the SDK returned an empty stream ("request
-      # ended without sending any chunks"), taking down the in-app AI assistant
-      # and invoice OCR. Do NOT let dependabot bump it until 0.32.x streaming is
-      # verified against Bedrock. Enforced by scripts/checks/no-new-antipatterns.mjs
-      # (pinned-dep). See DECISIONS.md (2026-07-08).
-      - dependency-name: "@anthropic-ai/bedrock-sdk"