From 274a97a749ba072f804c6a4b95e8f297b1eeb409 Mon Sep 17 00:00:00 2001 From: kingchenc Date: Mon, 27 Jul 2026 01:34:44 +0200 Subject: [PATCH] ci(dependabot): stop ci-pip version-update PRs (security-only) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The hash-locked CI dev tooling under .github/requirements/ is regenerated by scripts/update-lockfiles.sh (uv), which honours each lockfile's target Python via --python-version. Dependabot bumps the pinned .txt files directly and does NOT respect those targets, so every ci-pip group PR broke the 3.9 matrix rows — either dropping the `==` pin on a conditional dep (--require-hashes failure) or pulling py3.10-only pytest/numpy/hypothesis. Six such PRs broke (#367 numpy, #377/#379/#382/#384) and none merged. Set open-pull-requests-limit: 0 for this ecosystem to disable its version-update PRs; security updates are unaffected, and the tooling is refreshed manually via update-lockfiles.sh. --- .github/dependabot.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 7f6ca80e..4eaa2b57 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -72,7 +72,13 @@ updates: interval: monthly time: "06:00" timezone: "Etc/UTC" - open-pull-requests-limit: 10 + # Version-update PRs disabled (0): the hash-locked CI dev tooling is + # regenerated by scripts/update-lockfiles.sh (uv, which honours each row's + # target Python via --python-version). Dependabot bumps the .txt directly + # and does NOT respect those targets, so every ci-pip group PR broke the + # 3.9 rows (dropped `==` pins / pulled py3.10-only pytest/numpy/hypothesis). + # Security updates are unaffected by this limit. + open-pull-requests-limit: 0 cooldown: default-days: 7 commit-message: