code-server/.github/dependabot.yml

version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "daily"
      time: "11:00"
    ignore:
      # GitHub always delivers the latest versions for each major
      # release tag, so handle updates manually
      - dependency-name: "actions/*"
      - dependency-name: "github/codeql-action/*"
      - dependency-name: "microsoft/playwright-github-action"

  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "daily"
      time: "11:00"
    ignore:
      - dependency-name: "@types/node"
        versions: ["15.x", "14.x", "13.x"]
      - dependency-name: "xdg-basedir"
        # 5.0.0 has breaking changes as they switch to named exports
        # and convert the module to ESM
        # We can't use it until we switch to ESM across the project
        # See release notes: https://github.com/sindresorhus/xdg-basedir/releases/tag/v5.0.0
        versions: ["5.x"]
chore: use dependabot to manage dependencies (#2830) Use dependabot to manage the dependencies defined in package.json and GitHub Actions workflows, so that we can proactively update versions. Outdated versions of third-party dependencies frequently have known security vulnerabilities with CVEs. 2021-03-12 20:46:18 +01:00			`version: 2`
			`updates:`
			`- package-ecosystem: "github-actions"`
			`directory: "/"`
			`schedule:`
			`interval: "daily"`
			`time: "11:00"`
			`ignore:`
			`# GitHub always delivers the latest versions for each major`
			`# release tag, so handle updates manually`
			`- dependency-name: "actions/*"`
chore: add codeql-action to dependabot config 2021-04-28 00:22:59 +02:00			`- dependency-name: "github/codeql-action/*"`
chore: ignore updates to microsoft/playwright-github-action Microsoft publishes updates to this action using the same scheme as GitHub, where the v1 tag is updated to the latest release of the 1.0 series. Therefore, we can manage updates manually. 2021-05-12 16:58:12 +02:00			`- dependency-name: "microsoft/playwright-github-action"`
chore: use dependabot to manage dependencies (#2830) Use dependabot to manage the dependencies defined in package.json and GitHub Actions workflows, so that we can proactively update versions. Outdated versions of third-party dependencies frequently have known security vulnerabilities with CVEs. 2021-03-12 20:46:18 +01:00
			`- package-ecosystem: "npm"`
			`directory: "/"`
			`schedule:`
			`interval: "daily"`
			`time: "11:00"`
feat: add ignore block to dependabot config 2021-03-31 01:43:29 +02:00			`ignore:`
			`- dependency-name: "@types/node"`
chore: ignore 15.x @types/node updates 2021-04-28 00:25:38 +02:00			`versions: ["15.x", "14.x", "13.x"]`
chore(deps): limit xdg-basedir updates 2021-04-06 02:02:41 +02:00			`- dependency-name: "xdg-basedir"`
			`# 5.0.0 has breaking changes as they switch to named exports`
			`# and convert the module to ESM`
			`# We can't use it until we switch to ESM across the project`
			`# See release notes: https://github.com/sindresorhus/xdg-basedir/releases/tag/v5.0.0`
			`versions: ["5.x"]`