Samuel Newman
62 lines
1.7 KiB
YAML
62 lines
1.7 KiB
YAML
version: 2
|
|
# Dependabot auto-update config.
|
|
#
|
|
# npm and GitHub Actions use a 7-day cooldown so newly published versions age
|
|
# before a PR opens. Supply-chain attacks like
|
|
# the tanstack Shai-Hulud compromise (2026-05-11) live minutes-to-hours
|
|
# before the registry yanks them; a 7-day cooldown keeps poisoned
|
|
# versions out of our lockfiles.
|
|
#
|
|
# Security updates bypass cooldown and continue to flow immediately. Docker
|
|
# uses a shorter 3-day operational-freshness policy and does not support
|
|
# Dependabot security updates. See:
|
|
# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown
|
|
#
|
|
# Auto-merge is deliberately NOT enabled. Every dependabot PR gets human
|
|
# review.
|
|
|
|
updates:
|
|
- package-ecosystem: npm
|
|
directory: /
|
|
schedule:
|
|
interval: weekly
|
|
day: monday
|
|
cooldown:
|
|
default-days: 7
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
production:
|
|
dependency-type: production
|
|
update-types: [minor, patch]
|
|
development:
|
|
dependency-type: development
|
|
update-types: [minor, patch]
|
|
|
|
- package-ecosystem: github-actions
|
|
directory: /
|
|
schedule:
|
|
interval: weekly
|
|
day: monday
|
|
cooldown:
|
|
default-days: 7
|
|
open-pull-requests-limit: 3
|
|
groups:
|
|
actions:
|
|
patterns: ["*"]
|
|
update-types: [minor, patch]
|
|
|
|
- package-ecosystem: docker
|
|
directory: /
|
|
schedule:
|
|
interval: weekly
|
|
day: monday
|
|
time: "09:00"
|
|
timezone: America/Los_Angeles
|
|
cooldown:
|
|
default-days: 3
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
docker-base-images:
|
|
group-by: dependency-name
|
|
patterns: ["*"]
|