Compliance: wrong-limit-npm

[don-petry]

Compliance Finding

Category: dependabot
Severity: warning
Check: wrong-limit-npm

Detail

Dependabot npm ecosystem has open-pull-requests-limit: 10 (should be 0 for security-only policy)

Standard Reference

standards/dependabot-policy.md#policy

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

---

This issue was automatically created by the weekly compliance audit.

[don-petry]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[don-petry]

Claude finished @don-petry's task in 49s —— View job • claude/issue-173-20260414-1149

---

Fixing Dependabot npm open-pull-requests-limit

• Gather context
• Read current dependabot.yml
• Check dependabot policy standard
• Fix open-pull-requests-limit for npm ecosystem (changed 10 → 0)
• Commit and push
• Create PR

Change made: .github/dependabot.yml — npm ecosystem open-pull-requests-limit changed from 10 to 0. Per policy, application ecosystems (npm) should use 0 to suppress routine version-update PRs while still allowing security-alert-triggered PRs (which bypass the limit). The github-actions ecosystem correctly retains 10.

Create a PR — or view the already-created PR at #192

[don-petry]

Weekly Compliance Audit (2026-04-17)

This finding is still open.

Detail: Dependabot npm ecosystem has open-pull-requests-limit: 10 (should be 0 for security-only policy)

Standard: standards/dependabot-policy.md#policy

[don-petry]

Claude finished @don-petry's task in 1m 31s —— View job • claude/issue-173-20260418-1846 • [Create PR ➔](https://github.com/petry-projects/google-app-scripts/compare/main...claude/issue-173-20260418-1846?quick_pull=1&title=Issue%20%23173%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%23173%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

---

Fixing Dependabot npm open-pull-requests-limit

• Gather context
• Check current dependabot.yml on this branch (npm still had 10)
• Check status of previous PR fix: set npm open-pull-requests-limit to 0 for security-only policy #192 (still OPEN, not merged)
• Apply fix: set npm open-pull-requests-limit to 0
• Commit and push
• Create PR — #196
• Self-review PR fix: set npm open-pull-requests-limit to 0 for security-only policy #196 — single-line config change, correct per policy, no issues found
• Tagged @don-petry (CODEOWNER) for review

Change made: .github/dependabot.yml — npm ecosystem open-pull-requests-limit changed from 10 → 0. Per dependabot policy, application ecosystems use 0 to suppress routine version-update PRs while still allowing security-alert-triggered PRs (which bypass the limit). The github-actions ecosystem correctly retains 10.

Note: PR #192 (from a previous run) was still open and unmerged, which is why the compliance audit continued to flag this issue. PR #196 makes the same fix on the current branch.
| claude/issue-173-20260418-1846