Summary
Automated dependency updates to catch security vulnerabilities in dependencies (PyYAML, js-yaml, Jackson, etc.).
Instructions
Create .github/dependabot.yml
version: 2
updates:
- package-ecosystem: "pip"
directory: "/python"
schedule:
interval: "weekly"
labels:
- "dependencies"
- package-ecosystem: "npm"
directory: "/nodejs"
schedule:
interval: "weekly"
labels:
- "dependencies"
- package-ecosystem: "gomod"
directory: "/golang"
schedule:
interval: "weekly"
labels:
- "dependencies"
- package-ecosystem: "maven"
directory: "/java"
schedule:
interval: "weekly"
labels:
- "dependencies"
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
labels:
- "dependencies"
Verification
- File exists at
.github/dependabot.yml
- YAML is valid
- After push, Dependabot should create PRs for any outdated dependencies within a few hours
Summary
Automated dependency updates to catch security vulnerabilities in dependencies (PyYAML, js-yaml, Jackson, etc.).
Instructions
Create
.github/dependabot.ymlVerification
.github/dependabot.yml