From 8fdb71efe24cccf8d0ec462450e99a40451e7b1a Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Tue, 27 Oct 2026 11:12:53 -0500 Subject: [PATCH] Leave basecamp-sdk bumps to coworker's sdk-bump Dependabot ignores github.com/basecamp/basecamp-sdk/go for version updates; security updates still come, since they honour only an ignore's explicit versions. --- .github/dependabot.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 9cb5425e6..739ccc2d7 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -21,6 +21,14 @@ updates: semver-major-days: 7 semver-minor-days: 3 semver-patch-days: 2 + # basecamp-sdk bumps come from coworker's sdk-bump the day a release is + # published, as one PR that refreshes the vendorHash and opens even when + # the bump doesn't compile, with the errors listed. Each 0.x minor breaks + # the API, so Dependabot's grouped bump arrived days late and red (#911). + # A name-only ignore stops version updates and keeps security updates: + # Dependabot applies only an ignore's explicit `versions` to those. + ignore: + - dependency-name: "github.com/basecamp/basecamp-sdk/go" commit-message: prefix: "deps"