From ff8adcacd455d98903cfb3dfb82ffc189b832221 Mon Sep 17 00:00:00 2001 From: Claude Tuxedo Date: Fri, 11 Sep 2026 16:29:59 +0200 Subject: [PATCH] chore: let Dependabot watch Maven, npm and the workflow actions Most of the dependency chain dates from 2019-2020 and nothing signals when one of them ages or gets an advisory (lgnap/studio#3). This adds the visibility, and only that: Dependabot opens pull requests, CI judges them on both platforms, a human merges or closes. Maven once at the root, npm in web-ui/javascript, GitHub Actions for the workflows. Weekly, minor and patch grouped per ecosystem so the backlog of years does not arrive as fifty pull requests; majors one at a time, since each is a decision rather than a bump. Closes lgnap/studio#14 Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..5bee3638 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,33 @@ +# Dependency update visibility. Nothing here changes the build: Dependabot opens pull requests, +# CI judges them on both platforms like any other, and a human merges or closes. +# +# Maven is declared once at the root: it resolves the modules from the parent pom. The frontend +# lives in web-ui/javascript with its own lockfile, so npm is declared there. Minor and patch +# updates are grouped per ecosystem to keep the number of pull requests manageable on a project +# whose dependencies have not moved for years; majors come one at a time, since each one is a +# decision (Vert.x 4, react-scripts 5) rather than a bump. +version: 2 +updates: + - package-ecosystem: "maven" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 5 + groups: + maven-minor-and-patch: + update-types: ["minor", "patch"] + + - package-ecosystem: "npm" + directory: "/web-ui/javascript" + schedule: + interval: "weekly" + open-pull-requests-limit: 5 + groups: + npm-minor-and-patch: + update-types: ["minor", "patch"] + + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 2