This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/helix.git
The following commit(s) were added to refs/heads/master by this push:
new 4abad4988 Disable Dependabot automated version-bump PRs via .asf.yaml
4abad4988 is described below
commit 4abad49887abe6c606c498a287c9f2e191df04c4
Author: Junkai Xue <[email protected]>
AuthorDate: Wed Oct 14 14:59:12 2026 -0700
Disable Dependabot automated version-bump PRs via .asf.yaml
Dependabot bumps individual artifacts out of lockstep (e.g.
jackson-databind without jackson-core/annotations), which recently broke
the build and floods the PR queue with changes that are hard to verify.
Keep vulnerability alerts enabled, but stop the automated update PRs;
dependency upgrades will be done deliberately and in lockstep.
---
.asf.yaml | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/.asf.yaml b/.asf.yaml
index ab5947630..ac94b25e8 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -1,4 +1,8 @@
github:
+ # Keep vulnerability alerts visible, but stop Dependabot from opening
+ # automated version-bump PRs (hard to verify and they flood the PR queue).
+ dependabot_alerts: true
+ dependabot_updates: false
rulesets:
- name: "Default Branch Protection"
type: branch
