Matthew Jackson 53d9e15d3d Have Dependabot watch the dependencies, and land its PRs on dev ...

Version updates were never configured here -- only security alerts, which
report but never open a pull request. So the absence of Dependabot PRs was
not "nothing to update", it was "nothing was checking".

Updates target `dev`, never `main`. main is a release pointer that
release.sh moves to each tag, so a bot commit on it would put work there
that no tag contains -- the exact state that aborted the 1.6.2 cascade at
its last step, and pointing a scheduled bot at main would recreate it
weekly.

Minor and patch bumps are grouped into one PR rather than one per crate:
eight repos times a handful of dependencies is a volume nobody reads, and
an unread PR queue is indistinguishable from no updates at all.

The freemkv crates are excluded. They depend on each other by git tag,
re-pinned by release.sh inside the release commit, and Dependabot cannot
see that cascade -- a PR bumping one could pin a version whose tag does
not exist yet.

2026-08-09 16:48:29 -07:00

..

workflows

Scope the qa matrix to the platforms each crate actually supports

2026-08-05 21:22:30 -07:00

dependabot.yml

Have Dependabot watch the dependencies, and land its PRs on dev

2026-08-09 16:48:29 -07:00