From 6db2b6d172e309875b192b71d1c8809d5c13de15 Mon Sep 17 00:00:00 2001 From: lastlink Date: Mon, 2 Nov 2026 17:49:58 -0500 Subject: [PATCH] Add Dependabot twice a month for npm and GitHub Actions --- .github/dependabot.yml | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..c2ce77a --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,29 @@ +version: 2 +# Twice a month (the 1st and the 18th at 23:00), the same cron schedule as the bookkeeper-ui, doi and +# nazarick repos. Functional/security updates only: major versions are ignored and adopted +# deliberately. Each update is a pull request that runs .github/workflows/tests.yaml and merges once +# it passes. +updates: + # The package itself (dev dependencies: TypeScript, tsup, Vitest, ESLint, publint, ...). + # The projects under examples/ pin the framework versions they demonstrate, so they are left alone. + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "cron" + cronjob: "0 23 1,18 * *" + open-pull-requests-limit: 5 + ignore: + # Majors (a new Node floor, a new ESLint or TypeScript line) need a human. + - dependency-name: "*" + update-types: ["version-update:semver-major"] + + # Actions used in .github/workflows. + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "cron" + cronjob: "0 23 1,18 * *" + open-pull-requests-limit: 5 + ignore: + - dependency-name: "*" + update-types: ["version-update:semver-major"]