What — No .github/dependabot.yml and no renovate.json.
Why it matters here — Published package — its dependency tree ships to every consumer, and nothing reports a CVE in it. Comfy-Org/comfy-cli already runs Dependabot on a uv project.
Evidence
$ ls .github/dependabot.yml renovate.json .github/renovate.json 2>&1 | tail -1
ls: cannot access '.github/renovate.json': No such file or directory
Fix
Add .github/dependabot.yml for pip/uv and github-actions, weekly.
Found by repo-audit during repo improvement sweep 2026-08-17. Parent: #53
What — No
.github/dependabot.ymland norenovate.json.Why it matters here — Published package — its dependency tree ships to every consumer, and nothing reports a CVE in it.
Comfy-Org/comfy-clialready runs Dependabot on auvproject.Evidence
Fix
Add
.github/dependabot.ymlforpip/uvandgithub-actions, weekly.Found by
repo-auditduring repo improvement sweep 2026-08-17. Parent: #53