Remove invalid "security" label from dependabot.yml#667
Merged
Conversation
Dependabot was failing to open PRs with a "labels could not be found: security" config error. The generic "security" label collides with this repo's own vuln:*/threat:*/appsec taxonomy (this project is itself a security scanner), so rather than recreating it, drop it from both ecosystems. The per-ecosystem labels (python/github-actions) already provide the granularity, and GitHub auto-applies "dependencies" to Dependabot PRs regardless of this config.
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Labels: The following labels could not be found: security. Please create it before Dependabot can add it to a pull request.securitylabel collides with this repo's ownvuln:*/threat:*/appsec/supply-chaintaxonomy (this project is itself a security scanner), so it shouldn't be reused for repo-hygiene dependency PRs.securityfrom both thegithub-actionsandpipupdate stanzas. The per-ecosystem labels (python/github-actions) already provide granularity, and GitHub auto-applies thedependencieslabel to Dependabot PRs regardless of this config (confirmed empirically — 14 past PRs already carry it without being listed here).Also relevant: the Muninn scan flagged
mistune3.2.2 (PYSEC-2026-2210 / CVE-2026-59922, a ReDoS in the formatting plugin) on open PR #351 — that's already fixed onmainvia #396 (bumped tomistune==3.3.4, which is ≥3.3.0 and patched). PR #351 just predates that merge; rebasing it will clear both stale findings.Test plan