modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 4

chore(deps): sweep Dependabot alerts into board-tracked issues

Browse source 
Closes #2233 — the alert-consuming half of #2229. #2235 removed
`.github/dependabot.yml`, ending Dependabot's version-update PRs; this
ends its security-update PRs and replaces them with a daily sweep that
turns the alerts into ordinary board items.

- `scripts/dependabot-alerts.mjs` groups alerts by
  `(package, manifest_path, first_patched_version)` — one issue per
  BUMP, not per advisory — re-checks each vulnerable range against
  `v2/main`'s own lockfile before filing, and keys idempotency on a
  marker comment naming every GHSA the issue covers.
- `.github/workflows/dependabot-alerts.yml` runs it daily and on
  `workflow_dispatch`, with `vulnerability-alerts: read`.
- `semver` is declared at the repo root, per Dependency placement:
  `scripts/` is root-owned code with no manifest of its own.
- The sibling `dependency-refresh` comments no longer claim security
  updates are unaffected, and AGENTS.md gains the flow both halves
  now follow.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013H6Cew3KB3jVmQ5x4Dq1sq
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-09-03 21:13:39 -04:00 • committed by GitHub
commit 66a3332f1d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 1085 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

26
.github/workflows/dependency-refresh.yml vendored
View file

@ -2,19 +2,21 @@
#
# A Dependabot version-update PR carries no issue and no board card, so
# `.github/dependabot.yml` was removed outright in #2235 — npm and
# github-actions alike. This workflow is what replaced those PRs (security
# updates are a separate mechanism and stay on; see below): it runs
# `scripts/dependency-refresh.mjs` against `v2/main` once a month and files or
# updates ONE tracking issue listing every outdated npm package across the root
# install and each client, plus any workflow `uses:` ref behind its action's
# highest released version. No PR is opened automatically. A maintainer
# reviews the
# issue, picks what to bump, and opens a normal PR against `v2/main`.
# github-actions alike. This workflow is what replaced those PRs (the
# security-update half is a separate mechanism, switched off separately; see
# below): it runs `scripts/dependency-refresh.mjs` against `v2/main` once a
# month and files or updates ONE tracking issue listing every outdated npm
# package across the root install and each client, plus any workflow `uses:`
# ref behind its action's highest released version. No PR is opened
# automatically. A maintainer reviews the issue, picks what to bump, and opens
# a normal PR against `v2/main`.
#
# Dependabot SECURITY updates are unaffected: they are enabled in repo
# settings, not in a config file, and kept working while `dependabot.yml` was
# missing entirely (see #1833, #1840). They are raised against the default
# branch and still need retargeting by hand.
# Dependabot SECURITY updates are the other half, and #2233 turned their PRs
# off too — they were enabled in repo settings rather than in a config file,
# which is why they kept working while `dependabot.yml` was missing entirely
# (see #1833, #1840) and why deleting that file did not touch them. Its
# ALERTS stay on and are swept into issues daily by the sibling
# `dependabot-alerts.yml`. Between them, Dependabot opens no PRs here at all.
#
# `GITHUB_TOKEN` is sufficient: it only needs to read milestones and the public
# release feeds of the actions we use, and to create/edit an issue