From 69a25fd5158bb2987dcb9f84e32138d3b9575fd0 Mon Sep 17 00:00:00 2001 From: Arif Burak Demiray Date: Wed, 21 Oct 2026 21:36:27 +0300 Subject: [PATCH] Point Dependabot at staging Dependabot reads its configuration from the default branch, so the target-branch has to be set here for it to apply. Releases are tagged on staging; updates merged into master never reached a release (org.json 20260814 is on master but not on staging). The file matches the one the staging sync carries, so the next release merge does not conflict. --- .github/dependabot.yml | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index bce2dc92e..edf452cf5 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,10 +1,17 @@ version: 2 updates: - # Gradle dependencies. org.json is declared separately in sdk-java, app-java - # and app-javafx; Dependabot opens one PR per module, so check that a bump - # lands everywhere before closing the others. + # Gradle dependencies. org.json is declared separately in sdk-java, sdk-java-ui, + # app-java and app-javafx; Dependabot opens one PR per module, so check that a + # bump lands everywhere before closing the others. A bump of a published + # dependency also has to update .github/release-contract/, or the release + # checks fail. + # + # Releases are tagged on staging, so version updates target staging; master + # receives them with the next release. Security updates still open against + # master, so merge master into staging after taking one. - package-ecosystem: gradle directory: "/" + target-branch: staging schedule: interval: weekly day: monday @@ -16,6 +23,7 @@ updates: - package-ecosystem: github-actions directory: "/" + target-branch: staging schedule: interval: monthly labels: