Skip to content

docs: note Dependabot security updates are off in favour of Renovate #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shauneccles merged 1 commit into from
Sep 27, 2026
Merged

docs: note Dependabot security updates are off in favour of Renovate #17

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion MAINTAINING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,8 +57,11 @@ These live in GitHub, not in this repo. Renovate's automerge relies on them:
- `pypi` environment: deploys from `v*` tags only.
- Actions: workflow token is read-only by default and can't approve PRs.
- Security: Dependabot alerts on (Renovate reads them to raise `[SECURITY]`
PRs immediately), secret scanning and push protection on, private
PRs immediately) but Dependabot security updates off, so each advisory
gets one PR. Secret scanning and push protection on, private
vulnerability reporting on.
- Renovate skips forks that have no config, so `renovate.json` must stay on
`main`. Its runs are on the Mend dashboard (developer.mend.io).
- Issues enabled, for Renovate's Dependency Dashboard and bug reports.

## Supported versions
Expand Down
Loading