privacyfence 4.0.0__tar.gz

privacyfence-4.0.0/.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# All files require review from the repository owner.
+* @andras-tkcs

privacyfence-4.0.0/.github/dependabot.yml

@@ -0,0 +1,58 @@
+version: 2
+
+# Four ecosystems, matching the four places this repo declares a dependency version:
+# pyproject.toml (the daemon), mcpb/shim/package.json (the .mcpb shim),
+# cloudflare/downloads/package.json (the downloads.privacyfence.eu Worker,
+# docs/downloads-and-release-kpi.md), and the SHA-pinned `uses:`
+# lines in .github/workflows/*.yml themselves (see those files' own comments
+# on why they're pinned to a commit instead of a tag). A PR from any of
+# these four updates only the manifest/pin — it does not regenerate
+# requirements/*.lock.txt, which is a derived file; the
+# `lockfile-freshness` job in dependency-audit.yml catches a merged bump
+# that leaves the lock file stale before it reaches main, and
+# scripts/update_dependency_locks.sh is how a human (or a follow-up commit
+# on the Dependabot PR) brings it back in sync.
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      # Actions bump together in one PR -- they're independent third-party
+      # projects, not a coupled dependency graph, so there's nothing a
+      # per-action PR buys over reviewing one batch.
+      github-actions:
+        patterns: ["*"]
+
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    # pyproject.toml pins runtime deps with a floor (">=") and a handful of
+    # explicit ceilings whose reasons are documented inline there (mcp,
+    # webauthn, starlette, uvicorn) -- Dependabot respects an existing
+    # upper bound and won't propose crossing it, so those comments stay the
+    # real gate on a major bump either way.
+    groups:
+      python-dependencies:
+        patterns: ["*"]
+
+  - package-ecosystem: "npm"
+    directory: "/mcpb/shim"
+    schedule:
+      interval: "weekly"
+    groups:
+      shim-dependencies:
+        patterns: ["*"]
+
+  - package-ecosystem: "npm"
+    directory: "/cloudflare/downloads"
+    schedule:
+      interval: "weekly"
+    groups:
+      # package.json's `overrides.vitest` pin routes around a known npm/arborist resolution bug
+      # in this exact dependency set (see deploy-download-worker.yml's "Install dependencies"
+      # step comment) -- batching keeps a Dependabot bump from reintroducing that mismatch across
+      # two separate PRs.
+      downloads-worker-dependencies:
+        patterns: ["*"]