mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
jkomyno
83 lines
2.6 KiB
YAML
83 lines
2.6 KiB
YAML
# Dependabot configuration.
|
|
# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
|
|
#
|
|
# Grouping keeps the update/security-alert volume manageable (one PR per group
|
|
# instead of one per advisory). Routine minor/patch bumps are batched; major
|
|
# bumps still arrive individually so they get review.
|
|
# Schedule: every Friday at 06:30 UTC / 12:00 IST.
|
|
|
|
version: 2
|
|
updates:
|
|
# TypeScript / npm workspace
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "friday"
|
|
time: "06:30"
|
|
open-pull-requests-limit: 10
|
|
# These majors are compatibility boundaries exercised by explicit test
|
|
# lanes. Upgrade them manually with parallel old/new coverage. Dependabot
|
|
# security updates are not affected by update-type ignores.
|
|
ignore:
|
|
- dependency-name: "ai"
|
|
update-types: ["version-update:semver-major"]
|
|
- dependency-name: "openai"
|
|
update-types: ["version-update:semver-major"]
|
|
- dependency-name: "zod"
|
|
update-types: ["version-update:semver-major"]
|
|
# Version 1.0.0 is not compatible with the Effect package family in use.
|
|
- dependency-name: "@effect/printer-ansi"
|
|
versions: ["1.0.0"]
|
|
groups:
|
|
npm-production:
|
|
applies-to: version-updates
|
|
dependency-type: "production"
|
|
patterns: ["*"]
|
|
update-types: ["minor", "patch"]
|
|
npm-development:
|
|
applies-to: version-updates
|
|
dependency-type: "development"
|
|
patterns: ["*"]
|
|
update-types: ["minor", "patch"]
|
|
npm-security:
|
|
applies-to: security-updates
|
|
patterns: ["*"]
|
|
|
|
# Python SDK and provider packages
|
|
- package-ecosystem: "pip"
|
|
directories:
|
|
- "/python"
|
|
- "/python/providers/*"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "friday"
|
|
time: "06:30"
|
|
open-pull-requests-limit: 10
|
|
ignore:
|
|
# CrewAI 1.15.x requires Tomli 2.0.x. Keep patch and security updates,
|
|
# then remove this when CrewAI accepts a newer Tomli line.
|
|
- dependency-name: "tomli"
|
|
update-types:
|
|
- "version-update:semver-minor"
|
|
- "version-update:semver-major"
|
|
groups:
|
|
pip-version:
|
|
applies-to: version-updates
|
|
patterns: ["*"]
|
|
update-types: ["minor", "patch"]
|
|
pip-security:
|
|
applies-to: security-updates
|
|
patterns: ["*"]
|
|
|
|
# GitHub Actions workflow pins
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "friday"
|
|
time: "06:30"
|
|
groups:
|
|
github-actions:
|
|
patterns: ["*"]
|