mirror of
https://github.com/openfoodfoundation/openfoodnetwork
synced 2026-02-12 23:27:48 +00:00
f25d51e772
This should make us less vulnerable to supply chain attacks: - https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns
49 lines
1.2 KiB
YAML
49 lines
1.2 KiB
YAML
# Dependabot configuration
|
|
#
|
|
# The `directory` and `schedule.interval` options are mandatory.
|
|
# Most of the configuration here is not used for security updates though.
|
|
|
|
version: 2
|
|
|
|
multi-ecosystem-groups:
|
|
turbo_power:
|
|
schedule:
|
|
interval: "daily"
|
|
|
|
updates:
|
|
- package-ecosystem: "bundler"
|
|
directory: "/"
|
|
patterns: ["turbo_power"]
|
|
multi-ecosystem-group: "turbo_power"
|
|
|
|
# Only specific requirements are specified in Gemfile, so don't touch it.
|
|
versioning-strategy: lockfile-only
|
|
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
patterns: ["turbo_power"]
|
|
multi-ecosystem-group: "turbo_power"
|
|
|
|
# Only specific requirements are specified in package.json, so don't touch it.
|
|
versioning-strategy: lockfile-only
|
|
|
|
- package-ecosystem: "bundler"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "daily"
|
|
cooldown:
|
|
default-days: 7
|
|
|
|
# Only specific requirements are specified in Gemfile, so don't touch it.
|
|
versioning-strategy: lockfile-only
|
|
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "daily"
|
|
cooldown:
|
|
default-days: 7
|
|
|
|
# Only specific requirements are specified in package.json, so don't touch it.
|
|
versioning-strategy: lockfile-only
|