Skip to content

Explicitly configure dependabot so it detects more than just root-level Python. #79

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
erikrose wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Explicitly configure dependabot so it detects more than just root-level Python. #79

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
version: 2
updates:
- package-ecosystem: "pip"
directories:
- "/"
- "/examples/*"
schedule:
interval: "weekly"
open-pull-requests-limit: 10

- package-ecosystem: "cargo"
directories:
- "/"
- "/crates/wasiless"
Copy link
Copy Markdown
Member

@posborne posborne Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could probably make this use workspace deps which would reduce things down to a single manifest that needs to be considered.

Copy link
Copy Markdown
Member Author

@erikrose erikrose Apr 2, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm for it, though I'm having no luck at the moment due to a wit-bindgen version conflict that doesn't want to resolve. I also now doubt this explicit config is necessary, as dependabot's failure to open PRs for Rust packages may be due to it detecting those vulns before we had enabled PR-filing.

schedule:
interval: "weekly"
open-pull-requests-limit: 10
Loading