d39e3de1 chore: add dependabot config for npm and github-actions (#4794)
## What
Adds `.github/dependabot.yml` (new file — the repo had no dependabot
config tracked in git).
**Root `/` npm** — weekly, 14-day cooldown, minor/patch grouped into one
`routine-updates` PR, security updates grouped separately, `chore`
commit prefix, limit 10 open PRs.
**Root `/` github-actions** — same shape, `ci` commit prefix, limit 5
open PRs.
**Security-only for 12 packages** — `json-schema`, `admin-sdk`,
`angular`, `cli`, `create-builder.io`, `gatsby`, `plugin-loader`,
`plugin-tools`, `shopify`, `utils`, `webcomponents`, `widgets`. Each
uses `open-pull-requests-limit: 0` so routine version bumps are
suppressed and only grouped security updates open PRs.
## Why
The 14-day cooldown avoids churn from same-week patch releases, and
grouping keeps routine updates to one PR per ecosystem instead of one
per dependency. Security updates bypass grouping-with-routine so they
land on their own and are easy to triage.
## Not included
`examples/` and `plugins/` directories — intentionally left out.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Low Risk**
> CI/automation config only; no application runtime or auth logic
changes, though future Dependabot PRs will need normal review.
>
> **Overview**
> Introduces **`.github/dependabot.yml`** so the repo gets automated
dependency PRs where none existed before.
>
> **Root npm (`/`)** runs weekly with a 14-day cooldown, up to 10 open
PRs, `chore` commits, and grouped **minor/patch** (`routine-updates`)
plus separate **security** groups.
>
> **Root `github-actions`** mirrors that pattern with `ci` commits and a
cap of 5 open PRs.
>
> **Twelve package workspaces** under `packages/*` each get weekly npm
monitoring with **`open-pull-requests-limit: 0`**, so only grouped
**security** updates open PRs—no routine version bumps for those paths.
>
> `examples/` and `plugins/` are not configured.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
5da495ed92e2987a6077fe2423125730c80a7fb7. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> 7c8cab91 chore: add dependabot config for npm and github-actions (#4794)
## What
Adds `.github/dependabot.yml` (new file — the repo had no dependabot
config tracked in git).
**Root `/` npm** — weekly, 14-day cooldown, minor/patch grouped into one
`routine-updates` PR, security updates grouped separately, `chore`
commit prefix, limit 10 open PRs.
**Root `/` github-actions** — same shape, `ci` commit prefix, limit 5
open PRs.
**Security-only for 12 packages** — `json-schema`, `admin-sdk`,
`angular`, `cli`, `create-builder.io`, `gatsby`, `plugin-loader`,
`plugin-tools`, `shopify`, `utils`, `webcomponents`, `widgets`. Each
uses `open-pull-requests-limit: 0` so routine version bumps are
suppressed and only grouped security updates open PRs.
## Why
The 14-day cooldown avoids churn from same-week patch releases, and
grouping keeps routine updates to one PR per ecosystem instead of one
per dependency. Security updates bypass grouping-with-routine so they
land on their own and are easy to triage.
## Not included
`examples/` and `plugins/` directories — intentionally left out.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Low Risk**
> CI/automation config only; no application runtime or auth logic
changes, though future Dependabot PRs will need normal review.
>
> **Overview**
> Introduces **`.github/dependabot.yml`** so the repo gets automated
dependency PRs where none existed before.
>
> **Root npm (`/`)** runs weekly with a 14-day cooldown, up to 10 open
PRs, `chore` commits, and grouped **minor/patch** (`routine-updates`)
plus separate **security** groups.
>
> **Root `github-actions`** mirrors that pattern with `ci` commits and a
cap of 5 open PRs.
>
> **Twelve package workspaces** under `packages/*` each get weekly npm
monitoring with **`open-pull-requests-limit: 0`**, so only grouped
**security** updates open PRs—no routine version bumps for those paths.
>
> `examples/` and `plugins/` are not configured.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
5da495ed92e2987a6077fe2423125730c80a7fb7. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> d39e3de1 chore: add dependabot config for npm and github-actions (#4794)
## What
Adds `.github/dependabot.yml` (new file — the repo had no dependabot
config tracked in git).
**Root `/` npm** — weekly, 14-day cooldown, minor/patch grouped into one
`routine-updates` PR, security updates grouped separately, `chore`
commit prefix, limit 10 open PRs.
**Root `/` github-actions** — same shape, `ci` commit prefix, limit 5
open PRs.
**Security-only for 12 packages** — `json-schema`, `admin-sdk`,
`angular`, `cli`, `create-builder.io`, `gatsby`, `plugin-loader`,
`plugin-tools`, `shopify`, `utils`, `webcomponents`, `widgets`. Each
uses `open-pull-requests-limit: 0` so routine version bumps are
suppressed and only grouped security updates open PRs.
## Why
The 14-day cooldown avoids churn from same-week patch releases, and
grouping keeps routine updates to one PR per ecosystem instead of one
per dependency. Security updates bypass grouping-with-routine so they
land on their own and are easy to triage.
## Not included
`examples/` and `plugins/` directories — intentionally left out.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Low Risk**
> CI/automation config only; no application runtime or auth logic
changes, though future Dependabot PRs will need normal review.
>
> **Overview**
> Introduces **`.github/dependabot.yml`** so the repo gets automated
dependency PRs where none existed before.
>
> **Root npm (`/`)** runs weekly with a 14-day cooldown, up to 10 open
PRs, `chore` commits, and grouped **minor/patch** (`routine-updates`)
plus separate **security** groups.
>
> **Root `github-actions`** mirrors that pattern with `ci` commits and a
cap of 5 open PRs.
>
> **Twelve package workspaces** under `packages/*` each get weekly npm
monitoring with **`open-pull-requests-limit: 0`**, so only grouped
**security** updates open PRs—no routine version bumps for those paths.
>
> `examples/` and `plugins/` are not configured.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
5da495ed92e2987a6077fe2423125730c80a7fb7. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>