From 009abdce2b3e9db94ced632a1b5ff8dbb1a77710 Mon Sep 17 00:00:00 2001 From: Elian Doran Date: Sat, 8 Aug 2026 16:10:54 +0300 Subject: [PATCH] ci(deps): keep Dependabot off pdfjs-dist MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dependabot security updates are enabled repo-wide and need no configuration, so they have been proposing bare pdfjs-dist bumps — two are open right now against GHSA-hq66-cqwq-w95j. A bump without the matching re-vendor cannot open a PDF at all, so the PR is never mergeable as-is. This silences security PRs for pdfjs-dist as well as version ones. The advisory is fixed by dispatching update-pdfjs-viewer, which picks the same latest version and re-vendors the viewer alongside it. open-pull-requests-limit is 0 because declaring a package-ecosystem is what enables Dependabot's version updates; without it this file would start competing with Renovate across the whole repo. Co-Authored-By: Claude Opus 5 --- .github/dependabot.yml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000000..7261958a35 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,25 @@ +# Renovate owns version updates for this repository (see renovate.json). Dependabot is +# only active here for security updates, which need no configuration file — this one +# exists solely to carry the ignore below. +# +# open-pull-requests-limit: 0 disables Dependabot's *version* updates for the ecosystem; +# security updates are unaffected by it, which is why the ignore is needed as well. +version: 2 +updates: + - package-ecosystem: "npm" + directories: + - "/**" + schedule: + interval: "weekly" + open-pull-requests-limit: 0 + ignore: + # Bumping pdfjs-dist on its own produces a tree that cannot open a single PDF: + # pdf.js compares the library version against the viewer vendored under + # packages/pdfjs-viewer/viewer and refuses to start when they disagree. The + # update-pdfjs-viewer workflow bumps both together; a bot can only ever do half. + # + # This silences security PRs for pdfjs-dist too. That is the intended trade-off, + # not an oversight — an advisory is fixed by dispatching update-pdfjs-viewer, + # which picks up the same latest version and re-vendors alongside it. Watch the + # alert rather than waiting for the weekly run. + - dependency-name: "pdfjs-dist"