From 8c0b48088c0a14b9eaeb591ba6de167409309acc Mon Sep 17 00:00:00 2001 From: Niels Lohmann Date: Tue, 10 Nov 2026 21:45:05 +0100 Subject: [PATCH] ci: ignore Dependabot bumps of packages pinned by semgrep (#6062) semgrep requires exact or compatible-release versions of mcp, boltons and the opentelemetry packages. Bumping them alone makes the Semgrep job fail at pip install (see #6054, #6055, #6057, #6058, #6060, #6061), so leave them to move with the semgrep bump. Signed-off-by: Niels Lohmann --- .github/dependabot.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5336d0df5..727429823 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -60,3 +60,10 @@ updates: interval: daily cooldown: default-days: 7 + ignore: + # semgrep pins these packages to exact or compatible-release versions (see its METADATA); + # bumping them on their own makes the Semgrep job fail with ResolutionImpossible, so + # they only move together with a semgrep release + - dependency-name: mcp + - dependency-name: boltons + - dependency-name: "opentelemetry-*"