modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

chore(deps): move the dependabot.yml change out to #2235

Browse source 
The npm-entry removal in `.github/dependabot.yml` is split out of this PR so
that every change to that one file lands in a single reviewable piece —
alongside the `github-actions` entry, which #2229 had declared out of scope but
which opens the same issue-less, board-cardless PR the decision exists to
remove.

Reverts `.github/dependabot.yml` to its `v2/main` state, leaving this PR with
the release-time `npm audit fix` and the monthly `npm outdated` sweep: the
replacement flow, not the switch-off.

Both new files' header comments claimed the switch-off had already happened,
which is false until #2235 lands. They now say #2235 does it, and that until
then Dependabot's npm PRs and this sweep overlap — duplicate signal rather than
conflicting action.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RWMJENjs1mExXE5XPJTEei
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-09-03 20:15:59 -04:00 • committed by GitHub
commit ee14a9fc1c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 88 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

16
.github/workflows/dependency-refresh.yml vendored
View file

@ -1,11 +1,15 @@
# Monthly npm-outdated sweep (#2229), replacing Dependabot version-update PRs.
#
# Dependabot version updates are disabled in `.github/dependabot.yml` because a
# version-update PR carries no issue and no board card. This workflow runs
# `scripts/dependency-refresh.mjs` against `v2/main` once a month and files or
# updates ONE tracking issue listing every outdated package across the root
# install and each client — no PR is opened automatically. A maintainer reviews
# the issue, picks what to bump, and opens a normal PR against `v2/main`.
# A Dependabot version-update PR carries no issue and no board card, so npm
# version updates are being switched off in `.github/dependabot.yml`. That file
# is changed in #2235, not here — until it lands, Dependabot's npm PRs and this
# sweep overlap, which is duplicate signal rather than conflicting action.
#
# This workflow runs `scripts/dependency-refresh.mjs` against `v2/main` once a
# month and files or updates ONE tracking issue listing every outdated package
# across the root install and each client — no PR is opened automatically. A
# maintainer reviews the issue, picks what to bump, and opens a normal PR
# against `v2/main`.
#
# `GITHUB_TOKEN` is sufficient: it only needs to read milestones (public) and
# create/edit an issue (`issues: write`). Board placement is intentionally NOT