chore: reschedule and add npm target

[ysknsid25]

rescheduled depenadbot interval monthly to weekly.
It is best to update library versions frequently.
I’ll be reviewing them on my own initiative every week.

I have also included npm packages in the scope for Dependabot.
I will be checking these on a weekly basis as well.

Regarding major version updates, automatic updates are too risky, so we have decided to verify them ourselves.

Summary by CodeRabbit

Summary by CodeRabbit

• Chores
  • Automated dependency updates are now scheduled weekly for both npm packages and GitHub Actions (with GitHub Actions set to a Saturday time).
  • npm updates are scoped to key project directories, grouped to limit open pull requests, and use a longer default cooldown with a dependabot commit prefix.
  • Major semver updates for general dependencies (*) are ignored for safer automated rollouts.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Dependabot now manages weekly npm updates across configured directories with a five-PR limit, seven-day cooldown, commit-message prefix, grouped dependencies, and ignored semver-major updates. GitHub Actions updates now run weekly on Saturdays at 09:00, with semver-major updates ignored.

Suggested reviewers: yslpn

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly reflects the main changes: rescheduling Dependabot and adding npm coverage.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR updates the repository’s Dependabot configuration to check for updates weekly (instead of monthly) and expands coverage to include npm dependencies, aligning with the stated weekly review cadence.

Changes:

• Added a new Dependabot update configuration for the npm ecosystem at the repo root.
• Changed the existing github-actions update schedule from monthly to weekly and set an explicit day/time.
• Configured grouping and PR limits to manage update PR volume.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/valibot@1569

commit: 8ae1159

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/dependabot.yml:
- Around line 5-8: Adjust the weekly Dependabot configuration so the npm and
github-actions update groups do not impose an unintended additional 7-day delay;
reduce or remove each default-days setting while preserving the Saturday weekly
schedule and allowing every scheduled run to process available updates.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6e177582-dbde-4730-a4f0-babcb6b42827

📥 Commits

Reviewing files that changed from the base of the PR and between 62394c5 and ee1eb9d.

📒 Files selected for processing (1)

• .github/dependabot.yml

[cubic-dev-ai]

All reported issues were addressed across 1 file

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/dependabot.yml (1)

3-20: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Add the major-version exclusion to both update blocks.

The npm and github-actions Dependabot blocks currently have no ignore rule, so Dependabot can still open major-version dependency updates unless that behavior is intentional. Add ignore: - dependency-name: "*"; update-types: ["version-update:semver-major"] to both update sections.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/dependabot.yml around lines 3 - 20, Add an ignore rule to both the
npm and github-actions Dependabot update blocks, matching all dependency names
and excluding version-update:semver-major updates while preserving their
existing configuration.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/dependabot.yml:
- Around line 3-20: Add an ignore rule to both the npm and github-actions
Dependabot update blocks, matching all dependency names and excluding
version-update:semver-major updates while preserving their existing
configuration.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 69fa0eb3-baaa-4b9b-9cd9-3cfa1fc69482

📥 Commits

Reviewing files that changed from the base of the PR and between 09b006a and 385675b.

📒 Files selected for processing (1)

• .github/dependabot.yml