From 8d8ba73334cc7f397d8269dc107d8a1357a2d7f0 Mon Sep 17 00:00:00 2001 From: Derek Lewis Date: Wed, 12 Aug 2026 04:17:31 +0000 Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=8F=97=EF=B8=8F=F0=9F=9A=AE=EF=BC=9Ad?= =?UTF-8?q?rop=20the=20package=20rule=20that=20sets=20nothing?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `{ matchUpdateTypes: [...] }` with no settings beneath it applies no configuration -- package rules select what config attaches to, they do not decide what gets updated. Removing it changes no behaviour; renovate-config-validator is as happy after as before. Assisted-by: Claude-Code:claude-opus-5 --- .renovaterc.json5 | 3 --- 1 file changed, 3 deletions(-) diff --git a/.renovaterc.json5 b/.renovaterc.json5 index 8b6726015..838ce242f 100644 --- a/.renovaterc.json5 +++ b/.renovaterc.json5 @@ -58,9 +58,6 @@ ], packageRules: [ - { - matchUpdateTypes: ["minor", "patch", "pin", "digest"], - }, { matchDepTypes: ["dependencies"], commitMessagePrefix: "chore(deps):", From fb06c1db1a709eab840c53c9f62d86a043988784 Mon Sep 17 00:00:00 2001 From: Derek Lewis Date: Wed, 12 Aug 2026 04:17:31 +0000 Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=8F=97=EF=B8=8F=F0=9F=9A=AE=EF=BC=9As?= =?UTF-8?q?top=20dependabot=20duplicating=20renovate?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both were configured for npm, and dependabot has opened 560 pull requests here; #1700 has been sitting open since October. Narrowing it to what renovate misses leaves nothing: renovate extracted 98 dependencies from eleven files, including every manifest dependabot could have been pointed at -- the workflows, the dev container's Dockerfile and its features, .nvmrc, and package.json. Security updates are unaffected. They are a repository setting rather than a file, and both are on. Assisted-by: Claude-Code:claude-opus-5 --- .github/dependabot.yml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index 9eee59f86..000000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,12 +0,0 @@ -version: 2 -updates: - - package-ecosystem: npm - directory: "/" - schedule: - interval: daily - open-pull-requests-limit: 10 - # A week between a version being published and being proposed here, which - # is the window in which a compromised release tends to be caught and - # pulled. Security updates are not held back by this. - cooldown: - default-days: 7