From beee9efbfc85a2bd6512db6066f15d481dbe9a17 Mon Sep 17 00:00:00 2001 From: Lucas Ramos <3140800+lucas-d-ramos@users.noreply.github.com> Date: Mon, 26 Oct 2026 13:20:23 +0100 Subject: [PATCH] docs(dependabot): allow covers version updates only Dependabot ignores `allow: dependency-type` for security updates, so security fixes reach packages of packages too and take the normal path. Kept on purpose; the comment said `allow` stopped them. Comment-only. Canonical text: WeMoveEU/dependency-policy#33. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 982cea0..c7d7168 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -26,11 +26,13 @@ updates: applies-to: security-updates patterns: ["*"] # Direct dependencies only: what this manifest names. A package of a package is its - # parent's job — we never bump one, never pin one, never report one. The fix for a - # transitive advisory arrives when its parent ships a release that carries it. - # `allow` applies to version AND security updates, so this is also what stops the - # security stream opening PRs for transitive packages. Rule settled 2026-10-02; - # canonical shape in WeMoveEU/dependency-policy templates/tier*.yml. + # parent's job — we never pin one or override a parent's range. + # `allow` covers version updates only. Dependabot ignores it for security updates + # (dependabot-core updater/lib/dependabot/job.rb, `allowed_update?`), so security + # fixes arrive for packages of packages too and take the normal path: auto-merge where + # the tier has it, unless the bump is a major, which always waits for a person. + # Settled 2026-10-02, security exception 2026-10-26; canonical shape in + # WeMoveEU/dependency-policy templates/tier*.yml. allow: - dependency-type: "direct" ignore: