From d1d71183fae4c9c87dd850436ffad2b1caec6ede Mon Sep 17 00:00:00 2001 From: Jay Date: Wed, 3 Jun 2026 21:26:35 +0200 Subject: [PATCH] Add Dependabot version updates config Weekly, grouped version-update PRs for the npm and github-actions ecosystems to keep dependencies current with minimal PR noise. Security alerts and automated security fixes are enabled separately in the repo settings. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/dependabot.yml | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..92d19b3 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,33 @@ +version: 2 +updates: + # npm dependencies (Astro, Vercel adapter, Tailwind, Playwright, ...) + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "weekly" + # Group all npm bumps into a single PR to keep the noise down. + groups: + npm-dependencies: + patterns: + - "*" + open-pull-requests-limit: 5 + labels: + - "dependencies" + commit-message: + prefix: "deps" + prefix-development: "deps-dev" + + # GitHub Actions used in workflows (none yet, but future-proof). + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + groups: + github-actions: + patterns: + - "*" + labels: + - "dependencies" + - "github-actions" + commit-message: + prefix: "ci"