From 5a91cd9e2c7975f2aca658be1b6c70b3fd197060 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 1 Oct 2026 23:09:26 +0000 Subject: [PATCH] chore: add monthly, grouped Dependabot version updates The repo had no dependabot.yml, so the only Dependabot activity was security updates enabled in the repository settings, one PR per package. Version updates for npm and GitHub Actions (workflows plus the composite setup action) now run monthly. Each ecosystem opens at most two PRs a run: minor and patch bumps together, majors in a separate group. npm security updates are grouped along the same line; they still open when an advisory lands, since the schedule doesn't apply to them. DEVELOPMENT.md documents the cadence and the lockfile re-shake those PRs need; ARCHITECTURE.md drops Dependabot from its future-work list. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01EDadxCzrbML6jH3mM4J54d --- .github/dependabot.yml | 41 +++++++++++++++++++++++++++++++++++++++++ ARCHITECTURE.md | 1 - DEVELOPMENT.md | 6 ++++++ 3 files changed, 47 insertions(+), 1 deletion(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..cb4e766 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,41 @@ +# Version updates run monthly, grouped so each ecosystem opens at most two pull +# requests a run: one for every minor and patch bump, one for every major. Majors +# are kept apart because they are the ones that need reading before merging. +# +# Security updates are switched on in the repository settings, not here, and open +# as soon as an advisory lands whatever the schedule. The security-updates groups +# only batch them along the same minor/patch vs major line. +# +# Dependabot installs without lifecycle scripts, so npm PRs arrive with the +# lockfile unshaken and verify.yaml fails them. Run `npm install` on the branch +# and commit package-lock.json (DEVELOPMENT.md, "Lockfile dev flags"). +version: 2 +updates: + - package-ecosystem: npm + directory: / + schedule: + interval: monthly + groups: + npm-minor-patch: + update-types: [minor, patch] + npm-major: + update-types: [major] + npm-security-minor-patch: + applies-to: security-updates + update-types: [minor, patch] + npm-security-major: + applies-to: security-updates + update-types: [major] + + # `/` covers .github/workflows; composite actions are found by their own directory. + - package-ecosystem: github-actions + directories: + - / + - /.github/actions/* + schedule: + interval: monthly + groups: + actions-minor-patch: + update-types: [minor, patch] + actions-major: + update-types: [major] diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 34ea7aa..500510c 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -1234,7 +1234,6 @@ npm install parent-package@latest # Update parent if needed 3. **Accessibility** — More ARIA labels and keyboard navigation 4. **Documentation** — Inline code comments for complex logic 5. **Caching** — Service Worker for offline support -6. **Dependencies** — Automated dependency update checks (Dependabot) ## Glossary diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md index 05f9bbc..3a4c521 100644 --- a/DEVELOPMENT.md +++ b/DEVELOPMENT.md @@ -662,6 +662,12 @@ Pinned packages: `react`, `react-dom`, and `typescript` currently use `^` ranges rather than exact pins. Unpinned packages allow patch and minor updates for utilities and non-critical dependencies. +#### Automated Updates + +Dependabot (`.github/dependabot.yml`) checks npm packages and GitHub Actions on the first of each month. Each run opens at most two pull requests per ecosystem: one for all minor and patch bumps, one for all majors. Pinned packages are bumped like any other, so a `next` patch rides in the minor/patch PR. + +Security updates are enabled in the repository settings and open as soon as an advisory is published, whatever the schedule; they are grouped along the same minor/patch vs major line. An npm PR from either needs its lockfile re-shaken before `verify.yaml` will pass (see [Lockfile dev flags](#lockfile-dev-flags)). + #### Security Audits There is no automated `npm audit` gate in CI today — `verify.yaml` runs lint, typecheck, test, and (on PRs) a fixture build; `deploy.yaml` verifies, builds and deploys. Run audits locally (and before merging dependency changes):