FilesExpand file tree

main

/

dependabot.yml

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

74 lines (70 loc) · 3.18 KB

main

/

dependabot.yml

Copy path

Top

File metadata and controls

• Code
• Blame

74 lines (70 loc) · 3.18 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

version: 2

# Dependabot delivers dep updates as PRs that the supply-chain workflow

# (.github/workflows/supply-chain.yml) gates. Without this, security

# advisories disclosed against a transitive don't reach us until a

# human notices — Dependabot turns them into auditable PRs within hours.

#

# Each ecosystem gets its own schedule so the noise stays bounded.

# Larger workspace than sublinear-time-solver — bumped the per-eco

# open-PR caps slightly (10 cargo / 10 npm) so a noisy weekly run

# doesn't get truncated.

updates:

# ────────────────────────────────────────────────────────

# Rust — workspace root (covers ~136 member crates)

# ────────────────────────────────────────────────────────

- package-ecosystem: "cargo"

directory: "/"

schedule:

interval: "weekly"

day: "tuesday" # matches supply-chain.yml scheduled scan

time: "09:35"

timezone: "Etc/UTC"

open-pull-requests-limit: 10

# Group patch + minor bumps so we don't drown in single-dep PRs;

# majors stay separate because they may carry breaking changes.

groups:

cargo-minor-patch:

update-types: ["minor", "patch"]

labels: ["dependencies", "rust"]

commit-message:

prefix: "chore(deps)"

include: "scope"

# ────────────────────────────────────────────────────────

# npm — workspace at /npm (58 publishable packages)

# ────────────────────────────────────────────────────────

- package-ecosystem: "npm"

directory: "/npm"

schedule:

interval: "weekly"

day: "tuesday"

time: "09:35"

timezone: "Etc/UTC"

open-pull-requests-limit: 10

groups:

npm-minor-patch:

update-types: ["minor", "patch"]

labels: ["dependencies", "npm"]

commit-message:

prefix: "chore(deps)"

include: "scope"

versioning-strategy: "increase-if-necessary"

# Production deps only — devDeps drift is much less interesting

# from a supply-chain standpoint (jest/eslint bumps don't ship

# to users).

ignore:

- dependency-name: "*"

dependency-type: "development"

# ────────────────────────────────────────────────────────

# GitHub Actions — uses statements in .github/workflows/

# ────────────────────────────────────────────────────────

- package-ecosystem: "github-actions"

directory: "/"

schedule:

interval: "weekly"

day: "tuesday"

time: "09:35"

timezone: "Etc/UTC"

open-pull-requests-limit: 5

labels: ["dependencies", "github-actions"]

commit-message:

prefix: "chore(ci)"