Skip to content

Add Dependabot configuration for all 4 languages #12

Description

@thatsjet

Summary

Automated dependency updates to catch security vulnerabilities in dependencies (PyYAML, js-yaml, Jackson, etc.).

Instructions

Create .github/dependabot.yml

version: 2
updates:
  - package-ecosystem: "pip"
    directory: "/python"
    schedule:
      interval: "weekly"
    labels:
      - "dependencies"

  - package-ecosystem: "npm"
    directory: "/nodejs"
    schedule:
      interval: "weekly"
    labels:
      - "dependencies"

  - package-ecosystem: "gomod"
    directory: "/golang"
    schedule:
      interval: "weekly"
    labels:
      - "dependencies"

  - package-ecosystem: "maven"
    directory: "/java"
    schedule:
      interval: "weekly"
    labels:
      - "dependencies"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    labels:
      - "dependencies"

Verification

  • File exists at .github/dependabot.yml
  • YAML is valid
  • After push, Dependabot should create PRs for any outdated dependencies within a few hours

Metadata

Metadata

Assignees

No one assigned

    Labels

    P2Nice to have — improves adoptionci-cdCI/CD and release infrastructure

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions