From a26fcb1889c6b5d34976aed8b4b32e1001e9f353 Mon Sep 17 00:00:00 2001 From: Mohamed Elkholy Date: Tue, 9 Jun 2026 13:56:28 -0400 Subject: [PATCH] chore(deps): add npm/bun coverage to Dependabot Dependabot only watched the uv (Python) ecosystem, so the npm packages (web, vis, docs, install-counter-worker, feedback-worker) got no version updates and the 26 open npm security alerts had no remediation path. Add an npm package-ecosystem entry across the five JS directories with grouped weekly minor/patch bumps, mirroring the existing uv block. Pairs with enabling Dependabot automated-security-fixes for the alert backlog. --- .github/dependabot.yml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 9a29f805..08d73053 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -28,3 +28,27 @@ updates: # ~95 errors in `make check`). Hold until the type regression is resolved. - dependency-name: "click" versions: [">=8.4"] + + # npm/bun workspaces. Dev/build tooling and the Cloudflare workers carry the + # bulk of the open security alerts (vitest, vite, rollup, esbuild, hono, ...). + # `automated-security-fixes` remediates the alerts directly; these grouped + # version updates keep the lockfiles current so they don't drift back. + - package-ecosystem: "npm" + directories: + - "/web" + - "/vis" + - "/docs" + - "/packages/install-counter-worker" + - "/examples/feedback-worker" + schedule: + interval: "weekly" + day: "monday" + # Cap concurrent bot PRs so the queue stays reviewable. + open-pull-requests-limit: 5 + # Consolidate routine bumps into a single PR per directory; isolate majors + # so breaking changes get their own review. + groups: + minor-and-patch: + update-types: + - "minor" + - "patch"