wallabag/.github/dependabot.yml

version: 2
updates:
- package-ecosystem: npm
  directory: "/"
  schedule:
    interval: weekly
    time: "04:00"
    timezone: Europe/Paris
  open-pull-requests-limit: 10
  groups:
    babel-dependencies:
      patterns:
        - "*babel*"
    fontsource-dependencies:
      patterns:
        - "*fontsource*"
  ignore:
  - dependency-name: materialize-css
    versions:
    - "> 0.98.2"
- package-ecosystem: composer
  directory: "/"
  schedule:
    interval: daily
    time: "04:00"
    timezone: Europe/Paris
  open-pull-requests-limit: 10
  groups:
    symfony-dependencies:
      patterns:
        - "symfony/*"
  reviewers:
  - j0k3r
  - tcitworld
  - Kdecherf
  ignore:
  - dependency-name: lcobucci/jwt
    versions:
    - ">= 4.2.0"
  # until we add support for Symfony 5+
  - dependency-name: symfony/*
    versions:
    - ">= 5.0.0"
- package-ecosystem: github-actions
  directory: "/"
  schedule:
    interval: weekly
    time: "04:00"
    timezone: Europe/Paris
  open-pull-requests-limit: 10
Create Dependabot config file 2020-10-16 12:44:49 +02:00			`version: 2`
			`updates:`
			`- package-ecosystem: npm`
			`directory: "/"`
			`schedule:`
Remove dead test The URL seems to be down now. Move to a more frequent deps update 2022-01-05 13:25:50 +01:00			`interval: weekly`
Create Dependabot config file 2020-10-16 12:44:49 +02:00			`time: "04:00"`
			`timezone: Europe/Paris`
			`open-pull-requests-limit: 10`
Move grouping deps in the right place I put npm grouped deps inside the composer section, which is why it wasn't working. I move it in the right place and also added one grouped deps for Symfony* 2023-09-12 09:52:43 +02:00			`groups:`
			`babel-dependencies:`
			`patterns:`
			`- "babel"`
			`fontsource-dependencies:`
			`patterns:`
			`- "fontsource"`
Create Dependabot config file 2020-10-16 12:44:49 +02:00			`ignore:`
Update dependabot.yml Remove old lock in NPM after WebPack 5 update. Add `materialize-css` because the update looks like to complex. Remove `symfony/phpunit-bridge` lock 2020-12-07 09:30:25 +01:00			`- dependency-name: materialize-css`
Create Dependabot config file 2020-10-16 12:44:49 +02:00			`versions:`
Update dependabot.yml Remove old lock in NPM after WebPack 5 update. Add `materialize-css` because the update looks like to complex. Remove `symfony/phpunit-bridge` lock 2020-12-07 09:30:25 +01:00			`- "> 0.98.2"`
Create Dependabot config file 2020-10-16 12:44:49 +02:00			`- package-ecosystem: composer`
			`directory: "/"`
			`schedule:`
Remove dead test The URL seems to be down now. Move to a more frequent deps update 2022-01-05 13:25:50 +01:00			`interval: daily`
Create Dependabot config file 2020-10-16 12:44:49 +02:00			`time: "04:00"`
			`timezone: Europe/Paris`
			`open-pull-requests-limit: 10`
Move grouping deps in the right place I put npm grouped deps inside the composer section, which is why it wasn't working. I move it in the right place and also added one grouped deps for Symfony* 2023-09-12 09:52:43 +02:00			`groups:`
			`symfony-dependencies:`
			`patterns:`
Fix symfony pattern for dependabot `symfony` matches to much deps (ie `phpstan-symfony`) which aren't related to Symfony release. `symfony/*` will properly match Symfony release better. 2023-10-02 09:17:32 +02:00			`- "symfony/*"`
Create Dependabot config file 2020-10-16 12:44:49 +02:00			`reviewers:`
			`- j0k3r`
			`- tcitworld`
			`- Kdecherf`
Ignore lcobucci/jwt > 4.2.0 2022-12-16 13:40:12 +01:00			`ignore:`
			`- dependency-name: lcobucci/jwt`
			`versions:`
			`- ">= 4.2.0"`
Avoid deps for Symfony/* Until we release official support for Symfony 5+ 2023-10-02 08:35:01 +02:00			`# until we add support for Symfony 5+`
			`- dependency-name: symfony/*`
			`versions:`
			`- ">= 5.0.0"`
Included githubactions in the dependabot config This should help with keeping the GitHub actions updated on new releases. This will also help with keeping it secure. Dependabot helps in keeping the supply chain secure https://docs.github.com/en/code-security/dependabot GitHub actions up to date https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot https://github.com/ossf/scorecard/blob/main/docs/checks.md#dependency-update-tool Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com> 2022-04-19 20:55:41 +02:00			`- package-ecosystem: github-actions`
			`directory: "/"`
			`schedule:`
			`interval: weekly`
			`time: "04:00"`
			`timezone: Europe/Paris`
			`open-pull-requests-limit: 10`