From a41030e4bd6f1ced92b93e60e60d32a84468c490 Mon Sep 17 00:00:00 2001 From: G <41178744+catomean@users.noreply.github.com> Date: Sat, 29 Aug 2026 08:22:13 +0200 Subject: [PATCH] chore: add a dependency watcher MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 23 of 30 repos in the fleet had none. The symptom looks like neglect and is not: aoz-housing had 100 commits in August, features landing daily, and was still on Next 14 / React 18 / Tailwind 3 — because nothing ever OPENED the upgrade PR. Version drift here is the absence of a mechanism. npm directory: /. Minor and patch grouped so the sweep spends one cycle on them; majors stay separate because they deserve reading. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01UvjGNAS9CMfEGNW26tUR4P --- .github/dependabot.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..a646416 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,26 @@ +# Dependency updates, weekly. +# +# Added 2026-08-29 after a fleet audit found 23 of 30 repos had no watcher at +# all. The symptom looked like neglect and was not: aoz-housing had 100 commits +# that month and was still on Next 14, because nothing ever opened the PR. +# Drift here is the absence of a mechanism, not the absence of attention. +# +# Minor and patch are grouped into one PR so the auto-merge sweep spends one +# cycle on them instead of five; majors stay separate because they deserve to +# be read. +version: 2 +updates: + - package-ecosystem: npm + directory: "/" + schedule: + interval: weekly + open-pull-requests-limit: 5 + groups: + minor-and-patch: + update-types: [minor, patch] + + - package-ecosystem: github-actions + directory: "/" + schedule: + interval: weekly + open-pull-requests-limit: 3