Merge branch 'main' into feature/ios-token-refresh-sample

Author: ksroda-sa

.github/CODEOWNERS

@@ -1,5 +1,12 @@
 # All files require review
 * @SecureAuthCorp/team-eng-ciam-ui-write
 
+# Dependency manifests and lockfiles
+**/package.json @ksroda-sa
+**/package-lock.json @ksroda-sa
+**/yarn.lock @ksroda-sa
+**/pom.xml @ksroda-sa
+**/*.csproj @ksroda-sa
+
 # GitHub Actions and CI config
 .github/ @SecureAuthCorp/devops

.github/dependabot.yml

@@ -1,195 +1,151 @@
 version: 2
-updates:
-  - package-ecosystem: "npm"
-    directory: "/samples/react/login-pkce"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "npm"
-    directory: "/samples/react/token-refresh"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "npm"
-    directory: "/samples/angular/login-pkce"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
 
-  - package-ecosystem: "npm"
-    directory: "/samples/angular/token-refresh"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "npm"
-    directory: "/samples/vue/login-pkce"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "npm"
-    directory: "/samples/vue/token-refresh"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
+# Each framework groups its login-pkce + token-refresh directories into a
+# single entry via `directories:` (plural) — those samples share package.json
+# contents, so the bumps always travel together. Combined with
+# `groups: minor-and-patch`, this collapses what used to be ~57 open PRs into
+# ~5–7 steady-state.
+#
+# Major bumps still get individual PRs (groups only covers minor/patch) so a
+# human reads the changelog before merging.
+#
+# NOTE: Dependabot's YAML parser does NOT support aliases / merge keys, so the
+# common settings are duplicated explicitly below.
 
+updates:
+  # ── npm samples ─────────────────────────────────────────────────────────
   - package-ecosystem: "npm"
-    directory: "/samples/node/login-auth-code"
+    directories:
+      - "/samples/react/login-pkce"
+      - "/samples/react/token-refresh"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
+    open-pull-requests-limit: 3
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
   - package-ecosystem: "npm"
-    directory: "/samples/node/saml-sp-login"
+    directories:
+      - "/samples/angular/login-pkce"
+      - "/samples/angular/token-refresh"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
+    open-pull-requests-limit: 3
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
   - package-ecosystem: "npm"
-    directory: "/samples/node/token-refresh"
+    directories:
+      - "/samples/vue/login-pkce"
+      - "/samples/vue/token-refresh"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
+    open-pull-requests-limit: 3
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
-  # React Native samples — the auto-merge workflow excludes
-  # /samples/react-native/* by directory match, so bumps here always require
-  # human review. Dep bumps can break native autolinking / API shapes that
-  # `tsc --noEmit` doesn't catch. The "manual-review" label is informational
-  # only (the workflow filter is directory-based, not label-based).
   - package-ecosystem: "npm"
-    directory: "/samples/react-native/login-pkce"
+    directories:
+      - "/samples/node/login-auth-code"
+      - "/samples/node/saml-sp-login"
+      - "/samples/node/token-refresh"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-      - "manual-review"
+    open-pull-requests-limit: 3
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
+  # React Native — auto-merge workflow excludes /samples/react-native/* by
+  # directory match, so bumps always require human review. Dep bumps can break
+  # native autolinking / API shapes that `tsc --noEmit` doesn't catch. The
+  # "manual-review" label is informational (the workflow filter is dir-based).
   - package-ecosystem: "npm"
-    directory: "/samples/react-native/token-refresh"
+    directories:
+      - "/samples/react-native/login-pkce"
+      - "/samples/react-native/token-refresh"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-      - "manual-review"
+    open-pull-requests-limit: 3
+    labels: ["dependencies", "manual-review"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
   - package-ecosystem: "npm"
     directory: "/scripts"
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 3
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "maven"
-    directory: "/samples/java/login-auth-code"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "maven"
-    directory: "/samples/java/saml-sp-login"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
+  # ── Maven (Java) ────────────────────────────────────────────────────────
+  # Monthly cadence: Spring Boot + plugin updates move slower than npm.
   - package-ecosystem: "maven"
-    directory: "/samples/java/token-refresh"
+    directories:
+      - "/samples/java/login-auth-code"
+      - "/samples/java/saml-sp-login"
+      - "/samples/java/token-refresh"
     schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "nuget"
-    directory: "/samples/dotnet/login-auth-code"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "nuget"
-    directory: "/samples/dotnet/saml-sp-login"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
+      interval: "monthly"
+    open-pull-requests-limit: 3
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
+  # ── NuGet (.NET) ────────────────────────────────────────────────────────
+  # Monthly cadence: Microsoft.* packages bunch around SDK release cycles.
   - package-ecosystem: "nuget"
-    directory: "/samples/dotnet/token-refresh"
+    directories:
+      - "/samples/dotnet/login-auth-code"
+      - "/samples/dotnet/saml-sp-login"
+      - "/samples/dotnet/token-refresh"
     schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
+      interval: "monthly"
+    open-pull-requests-limit: 3
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
+  # ── GitHub Actions ──────────────────────────────────────────────────────
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
-    labels:
-      - "dependencies"
+    labels: ["dependencies"]

samples/angular/login-pkce/package.json

@@ -15,20 +15,20 @@
   },
   "dependencies": {
     "@angular/common": "21.2.11",
-    "@angular/compiler": "21.2.10",
+    "@angular/compiler": "21.2.11",
     "@angular/core": "21.2.11",
-    "@angular/forms": "21.2.10",
+    "@angular/forms": "21.2.11",
     "@angular/platform-browser": "21.2.11",
     "@angular/router": "21.2.11",
-    "angular-auth-oidc-client": "21.0.1",
+    "angular-auth-oidc-client": "21.0.2",
     "rxjs": "7.8.2",
     "tslib": "2.8.1"
   },
   "devDependencies": {
-    "@angular/build": "21.2.7",
-    "@angular/cli": "21.2.7",
+    "@angular/build": "21.2.9",
+    "@angular/cli": "21.2.9",
     "@angular/compiler-cli": "21.2.11",
-    "jsdom": "29.0.2",
+    "jsdom": "29.1.1",
     "prettier": "3.8.3",
     "typescript": "6.0.3",
     "vitest": "4.1.5"