Document Dependabot workflow and dependency conventions - #65
Merged
Conversation
Adds a "Dependencies & Dependabot" section covering the things that aren't derivable from reading the code: - the dependabot.yml grouping policy (majors stay individual on purpose) - why transitive CVEs are pinned with `overrides`, including the nested copyfiles → minimatch entry the root override can't reach, and the rule to bump the existing pin instead of adding a second one - the LTS-only policy for the Docker base image, and why #60 (Node 25) was closed without an `ignore` rule - that untyped JS deps now fail under TypeScript 7 with TS7016, which is why @mitchallen/uptime is vendored as src/uptime.ts Also notes that version-bump commits go straight to main, which is the one documented exception to the branch-and-PR rule. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a Dependencies & Dependabot section to
CLAUDE.md, capturing the decisions from the recent dependency work that aren't derivable from reading the code.dependabot.ymlgrouping policyoverridescopyfiles → minimatch → brace-expansionentry, which exists because copyfiles pins an old minimatch the root override can't reach. Plus the rule to bump the existing pin rather than add a second one — that pin has moved twice already (5.0.6 → 5.0.7 → 5.0.9)ignorerule, so Node 26 LTS still gets a PRany— the reason@mitchallen/uptimeis vendored assrc/uptime.ts, with a note not to re-add itAlso documents that version-bump commits go straight to
main(bare2.x.xmessage), the one existing exception to the branch-and-PR rule.Every factual claim was verified against the current tree: the
overridesblock, the24-alpinebase image, the three configured ecosystems,src/uptime.ts, and the pin's git history.Docs only — no source or config changes.
🤖 Generated with Claude Code