Skip to content

chore: add Dependabot config#317

Open
CorieW wants to merge 1 commit into
masterfrom
chore/add-dependabot-config
Open

chore: add Dependabot config#317
CorieW wants to merge 1 commit into
masterfrom
chore/add-dependabot-config

Conversation

@CorieW
Copy link
Copy Markdown
Member

@CorieW CorieW commented May 29, 2026

Features and why

  • Group Dependabot minor and patch updates to reduce Dependabot PRs.
  • Add a 7-day minimum release age for dependency updates to reduce chance of pulling newly compromised npm packages, such as the Mini Shai-Hulud worm attack.

Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a Dependabot configuration file (.github/dependabot.yml) to automate weekly npm dependency updates. The review feedback correctly identifies that the cooldown property is not supported by GitHub Dependabot and will cause schema validation to fail, recommending its removal.

Comment thread .github/dependabot.yml
@CorieW CorieW marked this pull request as ready for review May 29, 2026 15:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants