Let Dependabot open version updates for the workflow and Composer - #46
Merged
Merged
Conversation
Covers the two action references in the release workflow, both still pinned at v2, and the Composer dependencies under src/, where Twig, PHPMailer and composer itself come from. Docker and npm are left out, for reasons the file records.
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
cigamit
approved these changes
Aug 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
There is no
.github/dependabot.yml, so no version updates ever open here. This repository has never had a Dependabot pull request of any kind, and the dependency work has been by hand: #42Fix multiple CVEsand #43Fix Composer CVE: CVE-2026-59948both landed in the last weeks, each one a bump someone had to notice first.The two actions in
release.ymlare still pinned atv2, four majors behind thev6the other Ascender repositories run.What this covers
GitHub Actions. Both
uses:inrelease.yml, pinned to a SHA with the version in a comment, which Dependabot keeps in step.Composer,
/src.composer.jsonandcomposer.locksit together insrc/. Twig, PHPMailer,sebastian/diffandcomposer/composercome from there, andcomposer/composeris what #43 was.Weekly on Monday, matching the other repositories. No
groups:key, so one pull request per dependency. Dependabot creates the two labels the first time it opens one.What this leaves out, and why
Docker. Twice over. The three container files are named
db-dockerfile,parser-dockerfileandweb-dockerfile, which the docker ecosystem does not match, and all three build fromrockylinux/rockylinux:9, a floating major with nothing to bump until that major changes. Renaming them toDockerfilein their own directories would make them visible, but that is a separate change and it would still only offer the major jump.npm. The only
package.jsonfiles in the tree are the two inside the vendored copy of highlight.js undersrc/js/highlight, 513 files that are checked in rather than installed. Pointing npm at them would produce pull requests that cannot be merged as written.Tests
None: the file is configuration GitHub reads. It parses as YAML and follows the same shape as the config in
ascender, which is running.