From a0899d74db7623e2b139eda33dacd438fc67ef87 Mon Sep 17 00:00:00 2001 From: Hananel Hazan Date: Wed, 2 Sep 2026 19:37:36 -0400 Subject: [PATCH] chore: enable weekly Dependabot version updates Until now only Dependabot security updates ran on this repository. That is why poetry.lock drifted far enough to accumulate 12 open security alerts before anyone noticed, six of which were a single GitPython advisory left unfixed since PR #779 failed to deliver the bump (see #781). Two ecosystems, both weekly: pip minor and patch bumps arrive as one grouped pull request so routine maintenance is a single review. Major bumps stay separate. github-actions action versions are their own supply chain surface; a compromised action runs with access to the workflow. torch and torchvision are excluded from version updates. They are pinned to exact versions from the custom CUDA wheel index in pyproject.toml and have to move together, so routine bumps would break the pairing or pull the plain PyPI build instead. The exclusions are scoped to version-update types only, so security alerts for torch and torchvision still come through. Co-Authored-By: Claude Opus 5 --- .github/dependabot.yml | 55 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..3b800f0b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,55 @@ +version: 2 + +updates: + # Python dependencies, resolved through poetry.lock. + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + open-pull-requests-limit: 5 + labels: + - "dependencies" + # Minor and patch bumps arrive as a single grouped pull request so routine + # maintenance is one review, not twenty. Major bumps stay separate, because + # they need to be looked at individually. + groups: + python-minor-and-patch: + patterns: + - "*" + update-types: + - "minor" + - "patch" + ignore: + # torch and torchvision are pinned to exact versions served from the + # custom CUDA wheel index declared in pyproject.toml, and the two must + # move together. Routine version bumps here would break that pairing or + # silently pull the plain PyPI build instead, so they are upgraded by + # hand. These conditions cover version updates only; Dependabot security + # alerts for torch and torchvision still come through. + - dependency-name: "torch" + update-types: + - "version-update:semver-major" + - "version-update:semver-minor" + - "version-update:semver-patch" + - dependency-name: "torchvision" + update-types: + - "version-update:semver-major" + - "version-update:semver-minor" + - "version-update:semver-patch" + + # Keep the GitHub Actions used by CI current. Action versions are a supply + # chain surface of their own: a compromised or abandoned action runs with + # access to the workflow. + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + open-pull-requests-limit: 5 + labels: + - "dependencies" + groups: + github-actions: + patterns: + - "*"