Skip to content

chore: configure Dependabot updates #75

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sp3nx0r wants to merge 4 commits into
base: main
Choose a base branch
from
Open

chore: configure Dependabot updates #75

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
394eeee
chore: configure Dependabot updates
sp3nx0r Jul 10, 2026
2c02fd7
docs: add Dependabot trial design
sp3nx0r Jul 10, 2026
24652de
style: format Dependabot configuration
sp3nx0r Jul 10, 2026
43beb85
chore: keep major security updates separate
sp3nx0r Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
version: 2

updates:
- package-ecosystem: 'npm'
directory: '/'
schedule:
interval: 'weekly'
day: 'monday'
time: '11:00'
timezone: 'America/Los_Angeles'
cooldown:
default-days: 7

@mwood23 mwood23 Jul 10, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Noice! Didn't realize they had added this feature.

groups:
security-vulnerabilities-npm:
applies-to: 'security-updates'
update-types:
- 'minor'
- 'patch'
patterns:
- '*'

@mwood23 mwood23 Jul 10, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about something like this?

allow:
  - dependency-name: "*"
    update-types:
      - "version-update:semver-minor"
      - "version-update:semver-patch"

This would prevent major version bumps.

@sp3nx0r sp3nx0r Jul 10, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Implemented in 43beb85. I kept major updates enabled: an allow.update-types rule would suppress them entirely. Instead, the npm security group now matches only minor and patch updates. A security fix that requires a major bump remains alert-triggered and immediate, but opens as an individual PR rather than being batched. GitHub Actions remains unchanged because this repository uses major-only action tags, so a minor/patch SemVer filter would not be useful there.


- package-ecosystem: 'github-actions'
directory: '/'
schedule:
interval: 'weekly'
day: 'monday'
time: '11:00'
timezone: 'America/Los_Angeles'
cooldown:
default-days: 7
groups:
security-vulnerabilities-github-actions:
applies-to: 'security-updates'
patterns:
- '*'
Loading