mirror of
https://github.com/Fission-AI/OpenSpec.git
synced 2026-10-21 06:29:34 +08:00
dependabot[bot]andClay Good
6911f55175
* chore(deps): bump chalk from 5.6.2 to 6.0.0 Bumps [chalk](https://github.com/chalk/chalk) from 5.6.2 to 6.0.0. - [Release notes](https://github.com/chalk/chalk/releases) - [Commits](https://github.com/chalk/chalk/compare/v5.6.2...v6.0.0) --- updated-dependencies: - dependency-name: chalk dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * chore(nix): refresh dependency hash * fix(nix): use calculated dependency hash * fix(deps): preserve Node 20 chalk compatibility --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Clay Good <hi@claygood.com>
103 lines
3.1 KiB
YAML
103 lines
3.1 KiB
YAML
version: 2
|
|
|
|
# Dependabot does not manage two dependency surfaces in this repo:
|
|
# 1. pnpm `overrides` (pnpm-workspace.yaml + package.json, root and website) —
|
|
# transitive version pins that remediate advisories Dependabot can't otherwise
|
|
# reach. It never bumps or removes these; each carries an inline advisory
|
|
# comment noting the removal condition (see pnpm-workspace.yaml).
|
|
# 2. The Nix flake (flake.nix / flake.lock). Update nixpkgs manually with
|
|
# `nix flake update`; there is no Dependabot ecosystem for Nix. Note that the
|
|
# pnpmDeps FOD hash in flake.nix must be regenerated on any root lockfile change.
|
|
|
|
updates:
|
|
# Published CLI package
|
|
- package-ecosystem: npm
|
|
directory: /
|
|
schedule:
|
|
interval: weekly
|
|
day: monday
|
|
# Let a freshly published version sit before adopting it. Security updates
|
|
# ignore the cooldown, so this only delays routine bumps — long enough for a
|
|
# compromised release to be yanked before it reaches this repo.
|
|
cooldown:
|
|
default-days: 7
|
|
semver-major-days: 30
|
|
semver-minor-days: 7
|
|
semver-patch-days: 3
|
|
open-pull-requests-limit: 5
|
|
ignore:
|
|
- dependency-name: "@types/node"
|
|
update-types:
|
|
- version-update:semver-major
|
|
# Chalk 6 requires Node 22, while the published CLI supports Node 20.19.
|
|
- dependency-name: "chalk"
|
|
update-types:
|
|
- version-update:semver-major
|
|
- dependency-name: "typescript"
|
|
update-types:
|
|
- version-update:semver-major
|
|
commit-message:
|
|
prefix: chore
|
|
include: scope
|
|
groups:
|
|
production-dependencies:
|
|
dependency-type: production
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
development-dependencies:
|
|
dependency-type: development
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
|
|
# Documentation site (not published to npm)
|
|
- package-ecosystem: npm
|
|
directory: /website
|
|
schedule:
|
|
interval: weekly
|
|
day: monday
|
|
# Let a freshly published version sit before adopting it. Security updates
|
|
# ignore the cooldown, so this only delays routine bumps — long enough for a
|
|
# compromised release to be yanked before it reaches this repo.
|
|
cooldown:
|
|
default-days: 7
|
|
semver-major-days: 30
|
|
semver-minor-days: 7
|
|
semver-patch-days: 3
|
|
open-pull-requests-limit: 3
|
|
ignore:
|
|
- dependency-name: "@types/node"
|
|
update-types:
|
|
- version-update:semver-major
|
|
- dependency-name: "typescript"
|
|
update-types:
|
|
- version-update:semver-major
|
|
commit-message:
|
|
prefix: chore
|
|
include: scope
|
|
groups:
|
|
website-dependencies:
|
|
patterns:
|
|
- "*"
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
|
|
# CI workflow actions
|
|
- package-ecosystem: github-actions
|
|
directory: /
|
|
schedule:
|
|
interval: weekly
|
|
day: monday
|
|
# Actions are not semver-versioned the way packages are, so this ecosystem
|
|
# accepts default-days only.
|
|
cooldown:
|
|
default-days: 7
|
|
commit-message:
|
|
prefix: ci
|
|
groups:
|
|
github-actions:
|
|
patterns:
|
|
- "*"
|