Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.encoreos.io/llms.txt

Use this file to discover all available pages before exploring further.

This document describes how Dependabot is configured for this repository and how to enable or verify Dependabot alerts (vulnerability notifications) in GitHub.

​
Configuration in this repo

That file configures:
  • Version updates – Weekly (Mondays) checks for newer dependency versions and open PRs.
  • Security updates – When Dependabot detects a vulnerability, it can open a PR to fix it. This behavior works in conjunction with Dependabot alerts (see below).

​
What is covered

EcosystemDirectoriesSchedule
npm/, /vercel-teller-proxy, /packages/docsWeekly (Monday)
GitHub Actions/ (.github/workflows/)Weekly (Monday)
Root npm updates use a group for minor and patch versions so multiple compatible updates can be combined into one PR.

​
Dependabot alerts (vulnerability notifications)

Dependabot alerts are GitHub’s notifications when a known vulnerability is detected in your dependencies. They are not controlled by dependabot.yml; they are a repository (or organization) setting.

​
Enable or verify alerts for this repository

  1. On GitHub, open the repository and go to Settings.
  2. In the left sidebar, under Security, click Code security and analysis (or Advanced Security).
  3. Under Dependabot:
    • Dependabot alerts – Set to Enable so GitHub will create alerts and (when enabled) Dependabot security updates can open fix PRs.
    • Dependabot security updates – Optional. If enabled, Dependabot will open pull requests to fix vulnerable dependencies. Recommended.
For public repositories, Dependabot alerts are often enabled by default; you can still confirm the setting as above.

​
Where to see alerts

  • Security tab → Dependabot (or Security → Alerts).
  • Email/notifications for maintainers (if configured in GitHub notification settings).

​
Organization / account defaults

  • Organization: Settings → Security → Advanced Security → configure defaults for Dependabot alerts and security updates.
  • Personal account: Settings → Code security and analysis → enable/disable Dependabot alerts for your repos.

​
References