From 4b914b3531ae793494eaa3205de4f19bdd415d41 Mon Sep 17 00:00:00 2001 From: chris hay Date: Wed, 22 Jul 2026 10:47:18 +0100 Subject: [PATCH] Stop Renovate duplicating Dependabot's github-actions and security PRs Renovate's config:recommended preset covers github-actions, which overlapped with dependabot.yml's github-actions ecosystem entry and produced duplicate/conflicting PRs for the same actions (e.g. #246 vs #243 for actions/checkout, #223 vs #240/#238 for the artifact actions). It also raised its own vulnerability-fix PRs (e.g. #239) on top of GitHub's native Dependabot security alerts. Dependabot stays the sole authority for github-actions version bumps and security alerts; Renovate keeps handling pyproject.toml and pyenv currency, where Dependabot has no equivalent config. Signed-off-by: chris hay --- renovate.json | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index 5db72dd6..1ad8d8cc 100644 --- a/renovate.json +++ b/renovate.json @@ -2,5 +2,11 @@ "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ "config:recommended" - ] + ], + "github-actions": { + "enabled": false + }, + "vulnerabilityAlerts": { + "enabled": false + } }