mirror of
https://github.com/kilyabin/psysonic.git
synced 2026-07-21 14:05:41 +00:00
cucadmuh
c0d7079e88
Disable scheduled version-update PRs (open-pull-requests-limit: 0). Keep grouped security PRs per ecosystem; symphonia migration ignores unchanged.
47 lines
1.3 KiB
YAML
47 lines
1.3 KiB
YAML
# Dependabot: security updates only (no scheduled version bumps).
|
|
#
|
|
# Version updates are disabled via open-pull-requests-limit: 0. GitHub still opens
|
|
# PRs when Dependabot/npm/cargo audit reports a vulnerability (and related
|
|
# transitive fixes in the same bump). Routine minor/patch upgrades are manual.
|
|
#
|
|
# Requires "Dependabot security updates" enabled in repo Settings → Code security.
|
|
|
|
version: 2
|
|
updates:
|
|
- package-ecosystem: npm
|
|
directory: /
|
|
schedule:
|
|
interval: weekly
|
|
day: monday
|
|
open-pull-requests-limit: 0
|
|
labels:
|
|
- dependencies
|
|
- security
|
|
groups:
|
|
npm-security:
|
|
applies-to: security-updates
|
|
patterns:
|
|
- "*"
|
|
|
|
- package-ecosystem: cargo
|
|
directory: /src-tauri
|
|
schedule:
|
|
interval: weekly
|
|
day: monday
|
|
open-pull-requests-limit: 0
|
|
labels:
|
|
- dependencies
|
|
- security
|
|
groups:
|
|
cargo-security:
|
|
applies-to: security-updates
|
|
patterns:
|
|
- "*"
|
|
ignore:
|
|
# Symphonia 0.6 is a coordinated migration (API break + isomp4 patch port).
|
|
# See workdocs: internal/collaboration/tasks/2026-05-symphonia-0.6-migration/
|
|
- dependency-name: symphonia
|
|
versions: [">= 0.6"]
|
|
- dependency-name: symphonia-adapter-libopus
|
|
versions: [">= 0.3"]
|