Files
Peter Steinberger 939ca50837 chore(deps): enforce seven-day npm cooldowns and refresh eligible pins (#132385)
* chore(deps): enforce seven-day npm cooldowns

* fix(ci): preserve lint policy and isolate npm config fixtures

* docs(deps): clarify source cooldown toolchain requirements

* refactor(qa): share credential-safe setup error boundary

* test(deps): align reporting fixture with cooldown policy
2026-08-29 02:07:05 -07:00

147 lines
3.0 KiB
YAML

# Dependabot configuration
# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
version: 2
registries:
npm-npmjs:
type: npm-registry
url: https://registry.npmjs.org
token: ${{secrets.NPM_NPMJS_TOKEN}}
replaces-base: true
updates:
# npm dependencies (root)
- package-ecosystem: npm
directory: /
schedule:
interval: daily
cooldown:
default-days: 7
exclude:
- "@openai/codex"
- "@openai/codex-*"
groups:
production:
dependency-type: production
update-types:
- minor
- patch
development:
dependency-type: development
update-types:
- minor
- patch
open-pull-requests-limit: 20
registries:
- npm-npmjs
# GitHub Actions
- package-ecosystem: github-actions
directory: /
schedule:
interval: daily
cooldown:
default-days: 2
groups:
actions:
patterns:
- "*"
update-types:
- minor
- patch
open-pull-requests-limit: 5
# Swift Package Manager - macOS app
- package-ecosystem: swift
directory: /apps/macos
schedule:
interval: daily
cooldown:
default-days: 2
groups:
swift-deps:
patterns:
- "*"
update-types:
- minor
- patch
open-pull-requests-limit: 5
# Swift Package Manager - shared OpenClawKit
- package-ecosystem: swift
directory: /apps/shared/OpenClawKit
schedule:
interval: daily
cooldown:
default-days: 2
groups:
swift-deps:
patterns:
- "*"
update-types:
- minor
- patch
open-pull-requests-limit: 5
# Swift Package Manager - isolated MLX TTS helper
- package-ecosystem: swift
directory: /apps/macos-mlx-tts
schedule:
interval: daily
cooldown:
default-days: 2
groups:
swift-deps:
patterns:
- "*"
update-types:
- minor
- patch
open-pull-requests-limit: 5
# Swift Package Manager - Swabble
- package-ecosystem: swift
directory: /apps/swabble
schedule:
interval: daily
cooldown:
default-days: 2
groups:
swift-deps:
patterns:
- "*"
update-types:
- minor
- patch
open-pull-requests-limit: 5
# Gradle - Android app
- package-ecosystem: gradle
directory: /apps/android
schedule:
interval: daily
cooldown:
default-days: 2
groups:
android-deps:
patterns:
- "*"
update-types:
- minor
- patch
open-pull-requests-limit: 5
# Docker base images
- package-ecosystem: docker
directory: /
schedule:
interval: weekly
cooldown:
default-days: 2
groups:
docker-images:
patterns:
- "*"
open-pull-requests-limit: 5