[GH-ISSUE #56] Enable Dependabot or Renovate #6

New issue

Closed

opened 2026-10-26 22:40:25 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:40:25 +00:00

Owner

Originally created by @christian-byrne on GitHub (Aug 17, 2026).
Original GitHub issue: https://github.com/Comfy-Org/comfy-python-sdk/issues/56

Originally assigned to: @christian-byrne on GitHub.

What — No .github/dependabot.yml and no renovate.json.

Why it matters here — Published package — its dependency tree ships to every consumer, and nothing reports a CVE in it. Comfy-Org/comfy-cli already runs Dependabot on a uv project.

Evidence

$ ls .github/dependabot.yml renovate.json .github/renovate.json 2>&1 | tail -1
ls: cannot access '.github/renovate.json': No such file or directory

Fix

Add .github/dependabot.yml for pip/uv and github-actions, weekly.

Found by repo-audit during repo improvement sweep 2026-08-17. Parent: #53

Originally created by @christian-byrne on GitHub (Aug 17, 2026). Original GitHub issue: https://github.com/Comfy-Org/comfy-python-sdk/issues/56 Originally assigned to: @christian-byrne on GitHub.  **What** — No `.github/dependabot.yml` and no `renovate.json`. **Why it matters here** — Published package — its dependency tree ships to every consumer, and nothing reports a CVE in it. `Comfy-Org/comfy-cli` already runs Dependabot on a `uv` project. **Evidence** ``` $ ls .github/dependabot.yml renovate.json .github/renovate.json 2>&1 | tail -1 ls: cannot access '.github/renovate.json': No such file or directory ``` **Fix** Add `.github/dependabot.yml` for `pip`/`uv` and `github-actions`, weekly. --- Found by `repo-audit` during repo improvement sweep 2026-08-17. Parent: #53

bsakaguchi

2026-10-26 22:40:25 +00:00