From 73869a58c1dd5d740a4076c595fb390b267429ce Mon Sep 17 00:00:00 2001
From: revopushbot <null>
Date: Thu, 23 Jul 2026 13:28:09 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=84=20synced=20local=20'.github/depend?=
 =?UTF-8?q?abot.yml'=20with=20remote=20'shared/dependabot.yml'?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/dependabot.yml | 39 ++++++++++++++++++++++++++++++++++++---
 1 file changed, 36 insertions(+), 3 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f990b4a..f6e1749 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,7 +1,40 @@
 version: 2
+# Single source of truth for npm/pnpm Dependabot config, synced to
+# .github/dependabot.yml in every workers/ and pages/ repo (see .github/sync.yml).
+# Edit here only — the per-repo copies are overwritten on each sync.
+#
+# package-ecosystem: npm covers both pnpm-lock.yaml (workers) and
+# package-lock.json (pages).
 updates:
-  - package-ecosystem: "npm"
-    directory: "/"
+  # versioning-strategy: lockfile-only => package.json ranges are NEVER touched;
+  # Dependabot only re-resolves the lockfile within the existing semver ranges.
+  # Security PRs (enabled via the org's Dependabot security updates setting)
+  # inherit this strategy, so they too stay lockfile-only. Action SHA updates
+  # are owned by revopush/shared-workflows and arrive via automated-sync PRs.
+  - package-ecosystem: npm # also covers pnpm-lock.yaml
+    directory: /
+    # Dependabot's scheduler supports only daily/weekly/monthly — there is no
+    # cron / twice-weekly option (that is a Renovate feature). Weekly it is.
     schedule:
-      interval: "weekly"
+      interval: weekly
+      day: monday
+    versioning-strategy: lockfile-only
     open-pull-requests-limit: 5
+    labels: ["dependencies"]
+    commit-message:
+      prefix: "chore(deps)"
+    # Let a fresh release sit before adopting it, so a compromised publish is
+    # likely detected and yanked first. Security updates bypass cooldown and
+    # still open immediately. (Dependabot's built-in default is 3 days; we
+    # extend to 7 to cover slower-burn supply-chain campaigns.)
+    cooldown:
+      default-days: 7
+    groups:
+      # One combined PR for security fixes; fires immediately on new advisories.
+      security:
+        applies-to: security-updates
+        patterns: ["*"]
+      # One combined PR for routine in-range lockfile refreshes (weekly).
+      lockfile:
+        applies-to: version-updates
+        patterns: ["*"]