Repository navigation
fix(dependabot): unblock npm updates - #126
Merged
Merged
Conversation
|
Seems to be in line with GitHub's changelog on Dependabot no longer inferring |
britishrum
approved these changes
Oct 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot automatically adds GitHub Packages credentials to npm update jobs, even though this repo uses the public npm registry. Its registry validation rejects those credentials when the repo has no
.npmrc, so both security and version updates fail before resolving dependencies.Add an
.npmrcpointing to the public npm registry. This gives Dependabot the configuration it expects without adding a token. The project setting takes precedence over user-level registry settings, but an environment override still works.This is a workaround for the interaction reported in dependabot/dependabot-core#15415. Dependabot can only use it once it reaches
main, so we can confirm it with a new update job then. The existing security alerts still need dependency updates.