From 8d56a2b565cda74101be3d84177ea8e9d3ee8371 Mon Sep 17 00:00:00 2001 From: Stephen Robinson Date: Tue, 10 Nov 2026 11:17:24 +0000 Subject: [PATCH 1/2] chore: add Dependabot config, replacing Renovate Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 52 ++++++++++++++++++++++++++++++++++++++++++ renovate.json | 26 --------------------- 2 files changed, 52 insertions(+), 26 deletions(-) create mode 100644 .github/dependabot.yml delete mode 100644 renovate.json diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..8656a23 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,52 @@ +# Managed centrally: replaces Renovate. Security updates are enabled org-wide via GitHub code security configuration. +version: 2 +updates: + - package-ecosystem: "github-actions" + directories: + - "/" + schedule: + interval: "weekly" + day: "monday" + time: "06:00" + timezone: "Europe/London" + cooldown: + default-days: 7 + semver-major-days: 30 + open-pull-requests-limit: 5 + groups: + github_actions-minor-patch: + applies-to: version-updates + patterns: ["*"] + update-types: ["minor", "patch"] + github_actions-major: + applies-to: version-updates + patterns: ["*"] + update-types: ["major"] + github_actions-security: + applies-to: security-updates + patterns: ["*"] + + - package-ecosystem: "npm" + directories: + - "/" + schedule: + interval: "weekly" + day: "monday" + time: "06:00" + timezone: "Europe/London" + cooldown: + default-days: 7 + semver-major-days: 30 + open-pull-requests-limit: 5 + groups: + npm-minor-patch: + applies-to: version-updates + patterns: ["*"] + update-types: ["minor", "patch"] + npm-major: + applies-to: version-updates + patterns: ["*"] + update-types: ["major"] + npm-security: + applies-to: security-updates + patterns: ["*"] diff --git a/renovate.json b/renovate.json deleted file mode 100644 index a3dcbca..0000000 --- a/renovate.json +++ /dev/null @@ -1,26 +0,0 @@ -{ - "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "extends": [ - "config:recommended", - ":dependencyDashboard", - ":enableVulnerabilityAlerts", - "security:minimumReleaseAgeNpm", - ":maintainLockFilesWeekly" - ], - "autoApprove": true, - "automergeType": "pr", - "automerge": true, - "configMigration": true, - "labels": ["dependencies"], - "lockFileMaintenance": { - "enabled": true - }, - "major": { - "dependencyDashboardApproval": true - }, - "prConcurrentLimit": 1, - "prHourlyLimit": 0, - "rangeStrategy": "auto", - "rebaseWhen": "behind-base-branch", - "timezone": "Europe/London" -} From 72013b1690126ba9f198c2c2942253797758e621 Mon Sep 17 00:00:00 2001 From: Stephen Robinson Date: Tue, 10 Nov 2026 11:32:00 +0000 Subject: [PATCH 2/2] fix: only use semver cooldown for ecosystems that support it Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8656a23..8534adc 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -11,7 +11,6 @@ updates: timezone: "Europe/London" cooldown: default-days: 7 - semver-major-days: 30 open-pull-requests-limit: 5 groups: github_actions-minor-patch: