modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

chore(deps): move the dependabot.yml change out to #2235

Browse source 
The npm-entry removal in `.github/dependabot.yml` is split out of this PR so
that every change to that one file lands in a single reviewable piece —
alongside the `github-actions` entry, which #2229 had declared out of scope but
which opens the same issue-less, board-cardless PR the decision exists to
remove.

Reverts `.github/dependabot.yml` to its `v2/main` state, leaving this PR with
the release-time `npm audit fix` and the monthly `npm outdated` sweep: the
replacement flow, not the switch-off.

Both new files' header comments claimed the switch-off had already happened,
which is false until #2235 lands. They now say #2235 does it, and that until
then Dependabot's npm PRs and this sweep overlap — duplicate signal rather than
conflicting action.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RWMJENjs1mExXE5XPJTEei
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-09-03 20:15:59 -04:00 • committed by GitHub
commit ee14a9fc1c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 88 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

7
scripts/dependency-refresh.mjs
View file

@ -1,11 +1,12 @@
#!/usr/bin/env node
// Monthly npm-outdated sweep (#2229), replacing Dependabot version-update PRs.
//
// Dependabot's version updates were disabled in `.github/dependabot.yml`
// because a version-update PR carries no issue and no board card — the same
// A Dependabot version-update PR carries no issue and no board card — the same
// carve-out from "every PR references an issue" that the security-update flow
// had (that half is handled separately by the alert-driven pipeline, also
// #2229). This script replaces the routine-bump half: once a month it runs
// #2229). Turning npm version updates off in `.github/dependabot.yml` is #2235;
// this script is the replacement it switches over to, and lands first, so the
// two flows overlap until #2235 does. Once a month it runs
// `npm outdated` across the root install and every client under `clients/*`
// (each has its own package.json + lockfile — v2 is not a workspace), and
// files or updates ONE tracking issue listing everything behind. A maintainer