From 41cb253e62da21d5c959928ecac028dc0fe7603f Mon Sep 17 00:00:00 2001 From: Nawid Salehie <102778966+Nawid3333@users.noreply.github.com> Date: Wed, 30 Sep 2026 00:27:08 +0200 Subject: [PATCH] ci(dependabot): version updates for fsaunpack, each waiting for the owner fsaunpack (the helper that unpacks and serves a saved .fsa archive) has its own package.json and package-lock.json, and Dependabot watched it only for security updates, so express 5 never arrived as a pull request. It now gets a weekly entry of its own, with the same 5-day cooldown. Nothing merges by itself: update-prs.yml merges only pull requests that change nothing but the root package.json and pnpm-lock.yaml, and CI neither installs nor runs fsaunpack, so a green run says nothing about it. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 19 ++++++++++++++++++- docs/maintenance.md | 1 + 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e52b4c9d8..35ca5eb44 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -22,7 +22,8 @@ # # Security updates are separate from this file (Settings > Code security > # Dependabot security updates) and still open a PR for any vulnerable package, -# including the fsaunpack tool, which has its own package-lock.json. +# including the fsaunpack tool, which has its own package-lock.json (and its own +# entry below for version updates). version: 2 updates: - package-ecosystem: 'npm' @@ -72,6 +73,22 @@ updates: # come, so there is nothing for Dependabot to offer; the way on is Mediabunny. - dependency-name: 'mp4-muxer' + # fsaunpack: the helper that unpacks a saved .fsa archive and serves it with + # express (fsaunpack/, its own package.json and package-lock.json). It is not + # part of the extension, and CI neither installs nor runs it, so a green run says + # nothing about an update here. Every one waits for the owner: update-prs.yml + # merges only PRs that change nothing but the root package.json and + # pnpm-lock.yaml. + - package-ecosystem: 'npm' + directory: '/fsaunpack' + schedule: + interval: 'weekly' + cooldown: + default-days: 5 + open-pull-requests-limit: 5 + labels: + - 'dependencies' + # Workflow actions are pinned to a commit SHA with the version as a comment, # so a moved or hijacked tag cannot change what runs next to the AMO signing # keys. Nothing arrives on its own any more; Dependabot updates the SHA and diff --git a/docs/maintenance.md b/docs/maintenance.md index 375a82a19..bd4f17aad 100644 --- a/docs/maintenance.md +++ b/docs/maintenance.md @@ -14,6 +14,7 @@ workflows, which stay silent while they pass. | npm tooling, minor/patch | one grouped Dependabot PR a week (`tooling-minor-and-patch`) | merged by `update-prs.yml` | nothing (a comment on the PR records the merge) | | npm shipped libraries (fuse.js, pako, sortablejs) | one grouped Dependabot PR a week (`shipped-minor-and-patch`) | waits for you: the build copies them into the extension, so its bundle differs from the release's | one comment, and the assignment | | npm major | a Dependabot PR of its own | waits for you | one comment, and the assignment | +| fsaunpack (express) | a Dependabot PR for `fsaunpack/`, the helper that unpacks and serves a saved `.fsa` archive; not part of the extension | waits for you: CI does not run fsaunpack, so try it by hand before merging | one comment, and the assignment | | GitHub Actions | one grouped Dependabot PR a week (minor/patch), a major on its own | waits for you: it changes workflow files | one comment, and the assignment | | pnpm 11.x | a PR from `toolchain-updates.yml` (Mondays 07:00 UTC) on `toolchain/pnpm-`, changing only `packageManager`, once the release is 5 days old; one in conflict with `main` is rebuilt on it weekly | merged by `update-prs.yml` | nothing (a comment on the PR records the merge) | | pnpm next major | a PR from `toolchain-updates.yml`, once dependabot/dependabot-core#15904 is closed | waits for you | one comment, and the assignment |