FilesExpand file tree

main

/

dependabot.yml

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

168 lines (168 loc) · 5.44 KB

main

/

dependabot.yml

Copy path

Top

File metadata and controls

• Code
• Blame

168 lines (168 loc) · 5.44 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

version: 2

updates:

- package-ecosystem: gomod

directory: "/"

schedule:

interval: weekly

open-pull-requests-limit: 10

commit-message:

prefix: "chore(deps)"

ignore:

# mcp-go bumps are managed deliberately by the MCP protocol-upgrade

# track (#532): the SDK pin interacts with the frozen tool-surface

# goldens and the protocol-era behavior, so it must never ride the

# weekly go-dependencies group (a stray qa-gate nearly auto-merged

# v0.58.0 via #1017). Bump it in its own reviewed PR.

- dependency-name: "github.com/mark3labs/mcp-go"

groups:

go-dependencies:

patterns:

- "*"

- package-ecosystem: github-actions

directory: "/"

schedule:

interval: weekly

commit-message:

prefix: "chore(ci)"

groups:

# codeql-action's init/autobuild/analyze subpaths are separate

# dependencies to dependabot but must stay on the same version —

# skew makes analyze reject init's config file (broke CI: #895

# bumped only init to 4.37.3 while analyze stayed on 4.37.0).

codeql-action:

patterns:

- "github/codeql-action*"

- package-ecosystem: npm

directory: "/frontend"

schedule:

interval: weekly

open-pull-requests-limit: 10

commit-message:

prefix: "chore(deps)"

ignore:

# Revisit when vue-tsc + typescript-eslint support TypeScript 7.

# TS 7 cannot even `npm ci`: typescript-eslint peer-caps at <6.1.0 and

# vue-tsc fails on TS 7's package exports (see PR #869).

- dependency-name: "typescript"

versions: ["7.x"]

groups:

frontend-dependencies:

patterns:

- "*"

- package-ecosystem: npm

directory: "/website"

schedule:

interval: weekly

open-pull-requests-limit: 10

commit-message:

prefix: "chore(deps)"

groups:

website-dependencies:

patterns:

- "*"

- package-ecosystem: npm

directory: "/e2e/playwright"

schedule:

interval: weekly

open-pull-requests-limit: 5

commit-message:

prefix: "chore(deps)"

groups:

e2e-playwright-dependencies:

patterns:

- "*"

- package-ecosystem: npm

directory: "/e2e/web-ui-sweep"

schedule:

interval: weekly

open-pull-requests-limit: 5

commit-message:

prefix: "chore(deps)"

groups:

e2e-web-ui-sweep-dependencies:

patterns:

- "*"

# tests/echo-rugpull-server and tests/malicious-mcp-server are local-only

# npm fixtures for the quarantine/TPA scanner test suite (tests/README.md):

# never published, never shipped, spawned only from test tooling and bound

# to localhost. A vulnerable transitive dep here is alert noise, not a real

# exposure — but Dependabot previously had NO entry for either directory,

# so ten open alerts (5 per fixture, identical) sat unfixed because nothing

# ever opened a PR for them. Low limit + own commit prefix keep fixture

# bumps from competing with real dependency PRs for review attention.

- package-ecosystem: npm

directory: "/tests/echo-rugpull-server"

schedule:

interval: weekly

open-pull-requests-limit: 3

commit-message:

prefix: "chore(deps-fixtures)"

groups:

echo-rugpull-fixture-dependencies:

patterns:

- "*"

- package-ecosystem: npm

directory: "/tests/malicious-mcp-server"

schedule:

interval: weekly

open-pull-requests-limit: 3

commit-message:

prefix: "chore(deps-fixtures)"

groups:

malicious-mcp-fixture-dependencies:

patterns:

- "*"

# bench/tscg pins @tscg/core to an exact version (1.4.3) on purpose: the

# discovery-profiler benchmark (spec 083) reports figures — e.g. "TSCG

# (-23.8%)" in specs/085-compact-router/spec.md — that are only comparable

# run-to-run if the shim's encoding behavior doesn't drift. Auto-bumping it

# would silently invalidate published numbers, the same reason

# github.com/mark3labs/mcp-go is excluded from the gomod group above. No

# dependabot entry for bench/tscg; re-pin it manually, in its own reviewed

# commit, if a bump is ever warranted.

#

# cmd/mcpfixture/Dockerfile is `FROM scratch` (see the file's own header

# comment) — there is no base image for the docker ecosystem to track, so

# it has no entry below either.

- package-ecosystem: docker

directory: "/"

schedule:

interval: weekly

open-pull-requests-limit: 5

commit-message:

prefix: "chore(deps)"

- package-ecosystem: docker

directory: "/docker/scanners/cisco"

schedule:

interval: weekly

open-pull-requests-limit: 5

commit-message:

prefix: "chore(deps-scanners)"

- package-ecosystem: docker

directory: "/docker/scanners/proximity"

schedule:

interval: weekly

open-pull-requests-limit: 5

commit-message:

prefix: "chore(deps-scanners)"

- package-ecosystem: docker

directory: "/docker/scanners/ramparts"

schedule:

interval: weekly

open-pull-requests-limit: 5

commit-message:

prefix: "chore(deps-scanners)"

- package-ecosystem: docker

directory: "/docker/scanners/snyk"

schedule:

interval: weekly

open-pull-requests-limit: 5

commit-message:

prefix: "chore(deps-scanners)"

- package-ecosystem: docker

directory: "/docker/scanners/trivy"

schedule:

interval: weekly

open-pull-requests-limit: 5

commit-message:

prefix: "chore(deps-scanners)"