DOMPurify/.github/dependabot.yml at a9ca1e537422319a557a9a2aa61f003b23b4a197 · cure53/DOMPurify · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
version: 2
updates:
  # GitHub Actions: weekly, grouped. SHA-pinning means most updates are just
  # noise unless a real CVE lands; weekly cadence is plenty.
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
    groups:
      actions:
        patterns:
          - '*'
  # Main npm tree (build, test, lint tooling). Weekly + grouped minor/patch so
  # routine bumps land in one reviewable PR; majors stay separate.
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
    groups:
      dev-dependencies:
        patterns:
          - '*'
        update-types:
          - minor
          - patch
  # Consumer-shape verification harnesses under typescript/. These exist to
  # catch packaging regressions, not to ship code - group them all together
  # so we don't get six separate PRs every time @types/node bumps.
  - package-ecosystem: npm
    directory: /typescript
    schedule:
      interval: weekly
    groups:
      typescript-harness:
        patterns:
          - '*'
  - package-ecosystem: npm
    directory: /typescript/esm
    schedule:
      interval: weekly
    groups:
      typescript-harness:
        patterns:
          - '*'
  - package-ecosystem: npm
    directory: /typescript/esm-with-no-types
    schedule:
      interval: weekly
    groups:
      typescript-harness:
        patterns:
          - '*'
  - package-ecosystem: npm
    directory: /typescript/esm-with-specific-types
    schedule:
      interval: weekly
    groups:
      typescript-harness:
        patterns:
          - '*'
  # Legacy-browser harness: intentionally frozen old Playwright builds used
  # only to exercise DOMPurify against older engines. They are never shipped
  # and never updated (bumping them defeats the purpose). This entry exists
  # solely to stop Dependabot trying - and failing - to open security-update
  # PRs for them: open-pull-requests-limit 0 disables version PRs, and the
  # ignore suppresses the playwright security-update attempts. NOTE: this only
  # quiets Dependabot. OpenSSF Scorecard scans the lockfile via OSV separately
  # and needs a root osv-scanner.toml entry to clear GHSA-7mvr-c777-76hp.
  - package-ecosystem: npm
    directory: /test/legacy-playwright
    schedule:
      interval: weekly
    open-pull-requests-limit: 0
    ignore:
      - dependency-name: playwright
  # ---------------------------------------------------------------------
  # 2.x LTS branch. Dependabot watches exactly one branch per entry, so
  # the entries above (without target-branch) apply only to main. Mirror
  # the actions and root-npm entries here so 2.x receives routine
  # dependency updates too. The /typescript/... entries are not mirrored:
  # those harnesses don't exist on 2.x. Security updates (driven by GHSA
  # matches) reach 2.x automatically and bypass group settings, so an
  # incoming CVE patch lands as its own PR rather than being bundled
  # with the weekly grouped batch.
  # ---------------------------------------------------------------------
  - package-ecosystem: github-actions
    directory: /
    target-branch: '2.x'
    schedule:
      interval: weekly
    groups:
      actions:
        patterns:
          - '*'
  - package-ecosystem: npm
    directory: /
    target-branch: '2.x'
    schedule:
      interval: weekly
    groups:
      dev-dependencies:
        patterns:
          - '*'
        update-types:
          - minor
          - patch