From 7733f5529dbbf8fe9f7175d703caba31004bbfba Mon Sep 17 00:00:00 2001 From: Ruben Romero Montes Date: Tue, 21 Apr 2026 17:12:31 +0200 Subject: [PATCH 1/2] ci: add pip exclusion for msc/python test fixtures The dependabot config missed /src/test/resources/msc/python in the pip ecosystem exclusion, allowing security update PR #425 (mako bump) to be created for an intentionally-pinned test fixture. Co-Authored-By: Claude Opus 4.7 --- .github/dependabot.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6ea5bf61..15d1eeed 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -43,6 +43,7 @@ updates: directories: - "/src/test/resources/tst_manifests/pip/**" - "/src/test/resources/tst_manifests/it/pypi/**" + - "/src/test/resources/msc/python" schedule: interval: "monthly" labels: [] From a444e851e1f6cf8308d0f33a9b24916cff299f94 Mon Sep 17 00:00:00 2001 From: Ruben Romero Montes Date: Tue, 21 Apr 2026 17:22:21 +0200 Subject: [PATCH 2/2] ci: add root-level ignore-all for non-production ecosystems Per-directory entries with /** globs don't reliably suppress security updates (PRs #424, #426, #427 appeared after #422 was merged). Since this repo has no production npm/pip/go/gradle/cargo dependencies, add root-level entries with ignore-all + open-pull-requests-limit: 0 as a catch-all for security updates that bypass per-directory matching. Co-Authored-By: Claude Opus 4.7 --- .github/dependabot.yml | 46 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 15d1eeed..c21cade5 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -13,6 +13,52 @@ updates: schedule: interval: "weekly" + # ── Non-production ecosystems (no real deps, suppress everything) ──── + # The repo has no production npm/pip/go/gradle/cargo dependencies. + # A root-level ignore-all entry ensures security updates are also + # suppressed, since per-directory entries with globs don't reliably + # block them. + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "monthly" + open-pull-requests-limit: 0 + labels: [] + ignore: + - dependency-name: "*" + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "monthly" + open-pull-requests-limit: 0 + labels: [] + ignore: + - dependency-name: "*" + - package-ecosystem: "gomod" + directory: "/" + schedule: + interval: "monthly" + open-pull-requests-limit: 0 + labels: [] + ignore: + - dependency-name: "*" + - package-ecosystem: "gradle" + directory: "/" + schedule: + interval: "monthly" + open-pull-requests-limit: 0 + labels: [] + ignore: + - dependency-name: "*" + - package-ecosystem: "cargo" + directory: "/" + schedule: + interval: "monthly" + open-pull-requests-limit: 0 + labels: [] + ignore: + - dependency-name: "*" + # ── Test fixture manifests (suppress all updates including security) ─ # These directories contain intentionally pinned dependencies used as # test fixtures. They must NOT be updated by dependabot.