From 5b37a583ce52f2b714515e283f03f545870fd19a Mon Sep 17 00:00:00 2001
From: Dmitry Verkhoturov <paskal.07@gmail.com>
Date: Tue, 18 Aug 2026 19:59:49 +0100
Subject: [PATCH] Stop Dependabot npm updates, including security updates

Previously the npm entries carried only open-pull-requests-limit: 0, which
bounds version updates and leaves security updates unlimited, so npm pull
requests kept arriving from Dependabot alerts. The ignore option applies to
both kinds, so a blanket ignore per npm entry is what actually stops them.

Go modules and GitHub Actions updates are unchanged.
---
 .github/dependabot.yml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8a99a101..694b4289 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,11 @@
 # https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
 
 version: 2
+
+# npm updates are switched off entirely. open-pull-requests-limit bounds version
+# updates only, so the ignore entries below are what also stops security updates;
+# removing the npm entries would not work, as security updates come from alerts
+# rather than from this file.
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
@@ -23,6 +28,8 @@ updates:
   - package-ecosystem: "npm"
     directory: "/frontend"
     open-pull-requests-limit: 0
+    ignore:
+      - dependency-name: "*"
     schedule:
       interval: "monthly"
     groups:
@@ -33,6 +40,8 @@ updates:
   - package-ecosystem: "npm"
     directory: "/frontend/packages/api"
     open-pull-requests-limit: 0
+    ignore:
+      - dependency-name: "*"
     schedule:
       interval: "monthly"
     groups:
@@ -43,6 +52,8 @@ updates:
   - package-ecosystem: "npm"
     directory: "/frontend/e2e"
     open-pull-requests-limit: 0
+    ignore:
+      - dependency-name: "*"
     schedule:
       interval: "monthly"
     groups:
@@ -53,6 +64,8 @@ updates:
   - package-ecosystem: "npm"
     directory: "/frontend/apps/remark42"
     open-pull-requests-limit: 0
+    ignore:
+      - dependency-name: "*"
     schedule:
       interval: "monthly"
     groups:
@@ -63,6 +76,8 @@ updates:
   - package-ecosystem: "npm"
     directory: "/site"
     open-pull-requests-limit: 0
+    ignore:
+      - dependency-name: "*"
     schedule:
       interval: "monthly"
     groups: