dependabot.yml

# Copyright 2024 CodeIlluminators within The Commons Conservancy
# SPDX-License-Identifier: Apache-2.0
# SPDX-License-Identifier: MIT

version: 2
updates:
  # Configuration to check for updates in Node.js dependencies (using pnpm).
  - package-ecosystem: "npm"  # The package manager for the project (using "npm" ecosystem for pnpm).
    directory: "/"  # Directory where the package.json is located (root in this case).
    schedule:
      interval: "weekly"  # Frequency of the update checks (can be daily, weekly, or monthly).
    commit-message:
      prefix: "chore(deps)"  # Prefix added to commit messages for dependency updates.
    labels:
      - "dependencies"
      - "node"
      - "pnpm"
    open-pull-requests-limit: 5  # Limit the number of open pull requests created by Dependabot at a time.
    ignore:
      # List of specific dependencies to ignore for updates.
      # Useful for libraries where automatic updates might cause issues.
      - dependency-name: "next"
      - dependency-name: "babylon"
      - dependency-name: "typescript"
      - dependency-name: "autoprefixer"
      - dependency-name: "lucide-react"
      - dependency-name: "eslint-config-next"
      - dependency-name: "eslint"
    rebase-strategy: "auto"  # Automatically rebase pull requests if conflicts arise.

  # Labels:
  # - "dependencies": Applied to all pull requests related to dependency updates for easy tracking.
  # - "node": Specifically applied to Node.js (pnpm) updates.
  # - "rust": Specifically applied to Rust (Cargo) updates.

# You can add additional ecosystems (e.g., pip for Python) in future updates:
# - package-ecosystem: "pip"
#   directory: "/"
#   schedule:
#     interval: "weekly"
#   labels:
#     - "dependencies"
#     - "python"

# More advanced options like versioning-strategy can be added for more granular control over updates.