Reviewing PRs from Github Dependabot

justyy (84)in #blog • 3 days ago

If you have a .github/dependabot.yml

version: 2
updates:
  # Keep npm dependencies patched (security + minor updates).
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 5
    labels:
      - "dependencies"
    groups:
      # Batch low-risk dev tooling updates into a single PR.
      dev-dependencies:
        dependency-type: "development"
        update-types:
          - "minor"
          - "patch"

  # Keep GitHub Actions pinned versions fresh.
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    labels:
      - "dependencies"
      - "github-actions"

  # Keep the Docker base image up to date.
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"
    labels:
      - "dependencies"
      - "docker"

Then, weekly, the github will review the dependencies of the project: