Merge branch 'main' into dependabot/npm_and_yarn/samples/react/token-refresh/npm_and_yarn-32e07c5719

Author: ksroda-sa

.github/CODEOWNERS

@@ -1,5 +1,12 @@
 # All files require review
 * @SecureAuthCorp/team-eng-ciam-ui-write
 
+# Dependency manifests and lockfiles
+**/package.json @ksroda-sa
+**/package-lock.json @ksroda-sa
+**/yarn.lock @ksroda-sa
+**/pom.xml @ksroda-sa
+**/*.csproj @ksroda-sa
+
 # GitHub Actions and CI config
 .github/ @SecureAuthCorp/devops

.github/dependabot.yml

@@ -1,195 +1,151 @@
 version: 2
-updates:
-  - package-ecosystem: "npm"
-    directory: "/samples/react/login-pkce"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "npm"
-    directory: "/samples/react/token-refresh"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "npm"
-    directory: "/samples/angular/login-pkce"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
 
-  - package-ecosystem: "npm"
-    directory: "/samples/angular/token-refresh"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "npm"
-    directory: "/samples/vue/login-pkce"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "npm"
-    directory: "/samples/vue/token-refresh"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
+# Each framework groups its login-pkce + token-refresh directories into a
+# single entry via `directories:` (plural) — those samples share package.json
+# contents, so the bumps always travel together. Combined with
+# `groups: minor-and-patch`, this collapses what used to be ~57 open PRs into
+# ~5–7 steady-state.
+#
+# Major bumps still get individual PRs (groups only covers minor/patch) so a
+# human reads the changelog before merging.
+#
+# NOTE: Dependabot's YAML parser does NOT support aliases / merge keys, so the
+# common settings are duplicated explicitly below.
 
+updates:
+  # ── npm samples ─────────────────────────────────────────────────────────
   - package-ecosystem: "npm"
-    directory: "/samples/node/login-auth-code"
+    directories:
+      - "/samples/react/login-pkce"
+      - "/samples/react/token-refresh"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
+    open-pull-requests-limit: 3
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
   - package-ecosystem: "npm"
-    directory: "/samples/node/saml-sp-login"
+    directories:
+      - "/samples/angular/login-pkce"
+      - "/samples/angular/token-refresh"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
+    open-pull-requests-limit: 3
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
   - package-ecosystem: "npm"
-    directory: "/samples/node/token-refresh"
+    directories:
+      - "/samples/vue/login-pkce"
+      - "/samples/vue/token-refresh"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
+    open-pull-requests-limit: 3
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
-  # React Native samples — the auto-merge workflow excludes
-  # /samples/react-native/* by directory match, so bumps here always require
-  # human review. Dep bumps can break native autolinking / API shapes that
-  # `tsc --noEmit` doesn't catch. The "manual-review" label is informational
-  # only (the workflow filter is directory-based, not label-based).
   - package-ecosystem: "npm"
-    directory: "/samples/react-native/login-pkce"
+    directories:
+      - "/samples/node/login-auth-code"
+      - "/samples/node/saml-sp-login"
+      - "/samples/node/token-refresh"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-      - "manual-review"
+    open-pull-requests-limit: 3
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
+  # React Native — auto-merge workflow excludes /samples/react-native/* by
+  # directory match, so bumps always require human review. Dep bumps can break
+  # native autolinking / API shapes that `tsc --noEmit` doesn't catch. The
+  # "manual-review" label is informational (the workflow filter is dir-based).
   - package-ecosystem: "npm"
-    directory: "/samples/react-native/token-refresh"
+    directories:
+      - "/samples/react-native/login-pkce"
+      - "/samples/react-native/token-refresh"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-      - "manual-review"
+    open-pull-requests-limit: 3
+    labels: ["dependencies", "manual-review"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
   - package-ecosystem: "npm"
     directory: "/scripts"
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 3
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "maven"
-    directory: "/samples/java/login-auth-code"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "maven"
-    directory: "/samples/java/saml-sp-login"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
+  # ── Maven (Java) ────────────────────────────────────────────────────────
+  # Monthly cadence: Spring Boot + plugin updates move slower than npm.
   - package-ecosystem: "maven"
-    directory: "/samples/java/token-refresh"
+    directories:
+      - "/samples/java/login-auth-code"
+      - "/samples/java/saml-sp-login"
+      - "/samples/java/token-refresh"
     schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "nuget"
-    directory: "/samples/dotnet/login-auth-code"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "nuget"
-    directory: "/samples/dotnet/saml-sp-login"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
+      interval: "monthly"
+    open-pull-requests-limit: 3
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
+  # ── NuGet (.NET) ────────────────────────────────────────────────────────
+  # Monthly cadence: Microsoft.* packages bunch around SDK release cycles.
   - package-ecosystem: "nuget"
-    directory: "/samples/dotnet/token-refresh"
+    directories:
+      - "/samples/dotnet/login-auth-code"
+      - "/samples/dotnet/saml-sp-login"
+      - "/samples/dotnet/token-refresh"
     schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
+      interval: "monthly"
+    open-pull-requests-limit: 3
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
+  # ── GitHub Actions ──────────────────────────────────────────────────────
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
-    labels:
-      - "dependencies"
+    labels: ["dependencies"]

samples/dotnet/saml-sp-login/tests/saml-sp-login.tests.csproj

@@ -9,8 +9,8 @@
   </PropertyGroup>
   <ItemGroup>
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
-    <PackageReference Include="xunit" Version="2.9.2" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.0.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.0" />
     <!-- Override transitive dep with vulnerable System.Drawing.Common 4.7.0 (NU1904 / GHSA-rxg9-xrhp-64gj). -->
     <PackageReference Include="System.Drawing.Common" Version="8.0.10" />

samples/react-native/login-pkce/package.json

@@ -16,7 +16,7 @@
   },
   "dependencies": {
     "react": "19.2.3",
-    "react-native": "0.85.2",
+    "react-native": "0.85.3",
     "react-native-app-auth": "8.1.0",
     "react-native-config": "1.6.1",
     "react-native-safe-area-context": "5.7.0"