[fctl-sh]

Summary

Without a configuration Dependabot titles its pull requests "Bump x from 1.0.0 to 1.0.1", and this repository's Commits check refuses that, as hyperstructure/fctl's did for its first security update. .github/dependabot.yml titles them build(deps): bump …, and ci(deps): bump … for the workflows' actions. It keeps version updates off (open-pull-requests-limit: 0), so Dependabot still opens only the security updates the repository's settings turn on. I validated the file against SchemaStore's Dependabot schema and ran those titles through node scripts/lint-commit.mjs. A title that a long package name and its versions take past 72 characters still fails the check, and someone shortens it on the pull request.

The same change for hyperstructure/fctl, where Dependabot also had to update the npm workspace's root lockfile:

• ci: make Dependabot's security updates pass the checks fctl#254

Worth confirming

• Decision: Version updates stay off, as they are now. Raising open-pull-requests-limit turns them on for an ecosystem.
• Decision: Dependency updates are build, which waits for the next release, so a security fix to one of the three font packages that consumers install doesn't release by itself. Retitling that pull request fix(deps): … releases it when it merges.
• Assumption: Dependabot's security updates are on for this repository, or will be, as they are for hyperstructure/fctl. Without them this file does nothing; I can't see the repository's security settings.

fctl session