From 05998a5851ab54ace50f6b80ebd2758c08cccbc9 Mon Sep 17 00:00:00 2001 From: Lucas Ramos <3140800+lucas-d-ramos@users.noreply.github.com> Date: Fri, 2 Oct 2026 11:45:43 +0200 Subject: [PATCH] deps: Dependabot updates direct dependencies only `allow: dependency-type: direct` in every package-manager block. A package of a package is its parent's job and gets neither version nor security PRs from us. Canonical shape: WeMoveEU/dependency-policy templates/tier*.yml (#26). Co-Authored-By: Claude Fable 5.1 --- .github/dependabot.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 240120a..982cea0 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -25,6 +25,14 @@ updates: uv-security: applies-to: security-updates patterns: ["*"] + # Direct dependencies only: what this manifest names. A package of a package is its + # parent's job — we never bump one, never pin one, never report one. The fix for a + # transitive advisory arrives when its parent ships a release that carries it. + # `allow` applies to version AND security updates, so this is also what stops the + # security stream opening PRs for transitive packages. Rule settled 2026-10-02; + # canonical shape in WeMoveEU/dependency-policy templates/tier*.yml. + allow: + - dependency-type: "direct" ignore: - dependency-name: "*" update-types: ["version-update:semver-major"]