Skip to content

chore: configure Dependabot for the Bun ecosystem #125

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rozx merged 2 commits into from
Oct 10, 2026
Merged

chore: configure Dependabot for the Bun ecosystem #125

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
66d4139
chore: configure Dependabot for the Bun ecosystem
rozx Oct 10, 2026
1a7d4e7
Merge branch 'main' into chore/dependabot-bun
rozx Oct 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
# 项目由 Bun 管理（bun.lock），默认的 npm_and_yarn 生态无法更新 bun.lock，安全更新会失败。
# open-pull-requests-limit: 0 关闭定期版本更新 PR，只保留安全更新。
version: 2
updates:
- package-ecosystem: 'bun'
directory: '/'
schedule:
interval: 'weekly'
open-pull-requests-limit: 0

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge 不要关闭 Bun 唯一受支持的更新路径

GitHub 当前仅支持 Bun 的版本更新，不支持安全更新，且依赖图支持列表中也没有 Bun（参见 Dependabot 支持矩阵 和 依赖图生态列表）。在这种情况下，open-pull-requests-limit: 0 又会关闭版本更新，因此该配置不会生成任何依赖更新 PR，也无法恢复提交说明中失败的安全更新；应允许定期 Bun 版本更新，或改用实际支持 Bun 漏洞更新的工具/流程。

Useful? React with 👍 / 👎.

Loading