FilesExpand file tree

develop

/

dependabot.yml

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

111 lines (111 loc) · 3.88 KB

develop

/

dependabot.yml

Copy path

Top

File metadata and controls

• Code
• Blame

111 lines (111 loc) · 3.88 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

version: 2

updates:

- package-ecosystem: "github-actions"

directory: "/"

schedule:

interval: "cron"

cronjob: "0 0 * * *"

commit-message:

prefix: "chore(ci): "

groups:

actions-major:

patterns:

- "*"

exclude-patterns:

- "openai/codex-action"

ignore:

- dependency-name: "supabase/setup-cli"

update-types:

- "version-update:semver-major"

- dependency-name: "openai/codex-action"

# NOTE: this ecosystem's `versions` strings are parsed as Ruby

# Gem::Requirement (RubyGems comparator syntax), NOT npm-style semver

# ranges — "1.12.x" is not a wildcard here, it parses as a literal

# (and never-matching) version string, which is why the prior attempt

# at this silently failed to block v1.12 (PR #6541, 2026-09-09). Use

# real comparators instead.

versions:

- ">= 1.12, < 1.13"

# Deliberately pinned to v1.11 in ai-review.yml — v1.12 has two

# confirmed, still-open upstream regressions: a wrapper-level hang

# (openai/codex-action#151) and a runner-killing failure

# (openai/codex-action#160). A grouped Dependabot bump already

# silently reintroduced v1.12 once (PR #6484, 2026-09-07). Scoped to

# the 1.12 line (not a blanket ignore) so Dependabot still proposes

# v1.13+ once a fix ships; evaluate any such proposal in its own

# deliberate PR, checking the upstream changelog/issue tracker first

# — never bundle it into the actions-major group.

cooldown:

default-days: 7

- package-ecosystem: "gomod"

directories:

- "/apps/cli-go"

- "/apps/cli-go/pkg"

schedule:

interval: "cron"

cronjob: "0 0 * * *"

commit-message:

prefix: "chore(cli-go): "

groups:

go-minor:

update-types:

- minor

- patch

exclude-patterns:

- github.com/compose-spec/compose-go/v2

ignore:

- dependency-name: "github.com/compose-spec/compose-go/v2"

- dependency-name: "github.com/docker/cli"

- dependency-name: "github.com/docker/docker"

cooldown:

default-days: 7

- package-ecosystem: "npm"

directory: "/"

schedule:

interval: "cron"

cronjob: "0 0 * * *"

commit-message:

prefix: "fix(misc): "

prefix-development: "chore(misc): "

groups:

npm-major:

patterns:

- "*"

cooldown:

default-days: 7

- package-ecosystem: "docker"

directory: "/apps/cli/src/shared/services"

schedule:

interval: "cron"

cronjob: "0 0 * * *"

commit-message:

prefix: "fix(misc): "

groups:

docker-minor:

update-types:

- minor

- patch

# These lines are generated from packages/stack/src/Artifacts.ts (the single version table

# for slim-capable services); updates to them arrive through slim-release-published.yml, not

# Dependabot. Kong and pg14 (supabase/postgres) have no slim build either, but are bumped by

# hand, not by Dependabot. Dependabot keeps bumping only the images that remain genuinely

# upstream-only: migra, pg_prove, pgadmin-schema-diff.

ignore:

- dependency-name: "library/kong"

- dependency-name: "axllent/mailpit"

- dependency-name: "darthsim/imgproxy"

- dependency-name: "timberio/vector"

- dependency-name: "supabase/postgres"

- dependency-name: "supabase/gotrue"

- dependency-name: "postgrest/postgrest"

- dependency-name: "supabase/realtime"

- dependency-name: "supabase/storage-api"

- dependency-name: "supabase/edge-runtime"

- dependency-name: "supabase/studio"

- dependency-name: "supabase/postgres-meta"

- dependency-name: "supabase/logflare"

- dependency-name: "supabase/supavisor"

cooldown:

default-days: 7

exclude:

- "supabase/*"