Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions .github/dependabot.yml
Original file line number Diff line number Diff line change
Expand Up @@ -17,3 +17,21 @@ updates:
actions:
patterns:
- "*"

- package-ecosystem: npm
directory: /extensions/vscode
schedule:
interval: weekly
open-pull-requests-limit: 5
ignore:
# yarn.lock already resolves @types/vscode far above the declared
# engines.vscode floor (^1.74.0). Realign the two deliberately rather
# than let a bot churn a version no CI job builds or type-checks.
- dependency-name: "@types/vscode"
Comment on lines +26 to +30

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Instead of ignoring @types/vscode completely, you can restrict the ignore rule to only semver-major and semver-minor updates. This allows Dependabot to still supply patch updates (e.g., 1.74.x bug fixes) which remain fully compatible with the declared "engines": { "vscode": "^1.74.0" } constraint.

    ignore:
      # Bumping @types/vscode forces raising engines.vscode above ^1.74.0.
      - dependency-name: "@types/vscode"
        update-types:
          - "version-update:semver-major"
          - "version-update:semver-minor"

groups:
vscode-dependencies:
patterns:
- "*"
update-types:
- minor
- patch
Loading