mirror of
https://github.com/complexcaresolutions/cms.c2sgmbh.git
synced 2026-03-17 19:44:12 +00:00
Martin Porwoll
c85cf22496
- Daily npm dependency checks at 04:00 Europe/Berlin - Grouped updates: payload-core, react-nextjs, fullcalendar, dev-deps - Weekly GitHub Actions updates - Auto-merge workflow for patch updates after CI passes - Minor dev-dependency updates also auto-merged - Critical after CVE-2025-55182 incident on 2025-12-09
69 lines
1.7 KiB
YAML
69 lines
1.7 KiB
YAML
# Dependabot configuration for automated dependency updates
|
|
# Critical: CVE-2025-55182 compromise was caused by delayed security updates
|
|
version: 2
|
|
|
|
updates:
|
|
# npm (pnpm) dependencies - daily checks for security-critical updates
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "daily"
|
|
time: "04:00"
|
|
timezone: "Europe/Berlin"
|
|
labels:
|
|
- "dependencies"
|
|
# pnpm is auto-detected via lockfile
|
|
versioning-strategy: "increase"
|
|
open-pull-requests-limit: 20
|
|
groups:
|
|
payload-core:
|
|
patterns:
|
|
- "@payloadcms/*"
|
|
- "payload"
|
|
- "payload-oapi"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
react-nextjs:
|
|
patterns:
|
|
- "react"
|
|
- "react-dom"
|
|
- "next"
|
|
- "@types/react"
|
|
- "@types/react-dom"
|
|
- "eslint-config-next"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
fullcalendar:
|
|
patterns:
|
|
- "@fullcalendar/*"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
dev-dependencies:
|
|
dependency-type: "development"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
exclude-patterns:
|
|
- "@types/react"
|
|
- "@types/react-dom"
|
|
- "eslint-config-next"
|
|
commit-message:
|
|
prefix: "deps"
|
|
prefix-development: "deps(dev)"
|
|
include: "scope"
|
|
|
|
# GitHub Actions - weekly updates
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
time: "04:00"
|
|
timezone: "Europe/Berlin"
|
|
labels:
|
|
- "dependencies"
|
|
commit-message:
|
|
prefix: "deps(actions)"
|