[GH-ISSUE #56] Enable Dependabot or Renovate #4

New issue

Closed

opened 2026-10-31 22:03:35 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 22:03:35 +00:00

Owner

Originally created by @christian-byrne on GitHub (Aug 17, 2026).
Original GitHub issue: https://github.com/Comfy-Org/comfy-typescript-sdk/issues/56

Originally assigned to: @christian-byrne on GitHub.

What — No .github/dependabot.yml and no renovate.json.

Why it matters here — This is a published package — its dependency tree ships to every consumer. Nothing currently tells you when one of them has a published CVE. Comfy-Org/comfy-cli already runs Dependabot.

Evidence

$ ls .github/dependabot.yml renovate.json .github/renovate.json 2>&1 | tail -1
ls: cannot access '.github/renovate.json': No such file or directory

Fix

Add .github/dependabot.yml for npm and github-actions, weekly.

Found by repo-audit during repo improvement sweep 2026-08-17. Parent: #53

Originally created by @christian-byrne on GitHub (Aug 17, 2026). Original GitHub issue: https://github.com/Comfy-Org/comfy-typescript-sdk/issues/56 Originally assigned to: @christian-byrne on GitHub.  **What** — No `.github/dependabot.yml` and no `renovate.json`. **Why it matters here** — This is a published package — its dependency tree ships to every consumer. Nothing currently tells you when one of them has a published CVE. `Comfy-Org/comfy-cli` already runs Dependabot. **Evidence** ``` $ ls .github/dependabot.yml renovate.json .github/renovate.json 2>&1 | tail -1 ls: cannot access '.github/renovate.json': No such file or directory ``` **Fix** Add `.github/dependabot.yml` for `npm` and `github-actions`, weekly. --- Found by `repo-audit` during repo improvement sweep 2026-08-17. Parent: #53

bsakaguchi

2026-10-31 22:03:35 +00:00