create/.github/dependabot.yml at 50e07084394163f6110d0cb4621f8c372ba081ee · secondlife/create · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
# Dependabot configuration.
# Docs: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
#
# Strategy:
#   - Batch minor/patch bumps into a small number of grouped PRs to reduce review noise.
#   - Let major bumps arrive as individual PRs so breaking changes can be reviewed in isolation.
#   - Bundle all security advisories into a single PR (security PRs are otherwise always individual).
version: 2
updates:
  # ---------------------------------------------------------------------------
  # npm / pnpm packages (package.json + pnpm-lock.yaml)
  # ---------------------------------------------------------------------------
  - package-ecosystem: npm
    directory: "/"
    schedule:
      interval: weekly
    # Cap concurrent non-grouped PRs (e.g. major bumps). Grouped PRs don't count.
    open-pull-requests-limit: 10
    assignees:
      - mcgroarty
    ignore:
      # js-yaml v5 dropped its CommonJS default export. Astro and
      # @astrojs/starlight consume js-yaml via `import yaml from 'js-yaml'`,
      # which fails at build time with:
      #   "The requested module 'js-yaml' does not provide an export named 'default'"
      # Hold at v4 until upstream Astro/Starlight switch to named imports,
      # then remove this ignore.
      #
      # Note: `ignore` blocks routine version updates only. Security-driven
      # updates from the GitHub Advisory Database are unaffected and will
      # still open PRs if a CVE lands against js-yaml 4.x.
      - dependency-name: "js-yaml"
        update-types:
          - "version-update:semver-major"
    groups:
      # Astro + first-party plugins move together; keep them in their own PR
      # so an Astro upgrade isn't buried in unrelated dependency churn.
      # Listed first so these packages land here instead of in production-dependencies.
      #
      # Includes "major" (unlike other groups) because Astro's ecosystem
      # packages have tightly coupled peer-dependency requirements: a
      # Starlight minor bump can require an Astro major bump. Grouping majors
      # here keeps the ecosystem in sync in a single PR. Note: 0.x → 0.y
      # bumps for @astrojs/* packages are classified as "minor" by SemVer
      # but frequently contain breaking changes, so review carefully.
      astro:
        patterns:
          - "astro"
          - "@astrojs/*"
        update-types:
          - "major"
          - "minor"
          - "patch"
      # Everything else in `dependencies` (runtime).
      production-dependencies:
        dependency-type: production
        update-types:
          - "minor"
          - "patch"
      # Everything in `devDependencies` (tooling, types, etc.).
      dev-dependencies:
        dependency-type: development
        update-types:
          - "minor"
          - "patch"
      # Security advisories. `applies-to: security-updates` is required because
      # security PRs are individual by default, even when they match a version-update group.
      security-updates:
        applies-to: security-updates
        patterns:
          - "*"

  # ---------------------------------------------------------------------------
  # GitHub Actions used in .github/workflows/
  # ---------------------------------------------------------------------------
  - package-ecosystem: github-actions
    directory: "/"
    schedule:
      interval: weekly
    assignees:
      - mcgroarty
    groups:
      actions:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"