22# Dependabot Configuration
33#
44# Purpose:
5- # • Keep Go modules, GitHub Actions and DevContainer images/features
6- # base images up‑to‑date with zero‑day security patches and semantic‑version
7- # upgrades.
5+ # • Keep GitHub Actions updated with the latest security patches and features.
86# • Reduce attack surface by limiting outdated dependencies.
97# • Minimise PR noise via smart grouping and sane pull‑request limits.
108#
1311# https://docs.github.com/en/code-security/dependabot/configuration-options-for-dependency-updates
1412#
1513# Security Hardened Defaults:
16- # • Weekly cadence (Monday 09 :00 America/New_York) – align with CVE dump cycle .
14+ # • Weekly cadence (Tuesday 11 :00 America/New_York) – align with typical maintenance windows .
1715# • Direct dependencies only – prevents unsolicited transitive churn.
18- # • PRs labeled, assigned, and target the protected " master" branch.
16+ # • PRs labeled, assigned, and target the protected master branch.
1917# • PR titles prefixed with chore(scope): – conventional commits.
2018# • Force‑push and delete‑branch disabled via branch‑protection rules.
2119# • PR limit = 10 to avoid queue flooding.
22- # • All dependency PRs require passing CI + CODEOWNERS review .
20+ # • All dependency PRs require passing CI checks before merging .
2321# ────────────────────────────────────────────────────────────────
2422
2523version : 2
@@ -33,19 +31,15 @@ updates:
3331 target-branch : " master"
3432 schedule :
3533 interval : " weekly"
36- day : " monday "
37- time : " 09 :00"
34+ day : " tuesday "
35+ time : " 11 :00"
3836 timezone : " America/New_York"
3937 allow :
4038 - dependency-type : " direct"
4139 groups :
42- security-deps :
43- patterns :
44- - " *crypto*"
45- - " *security*"
46- - " *auth*"
47- - " *jwt*"
48- - " *oauth*"
40+ gomod-all :
41+ applies-to : version-updates
42+ patterns : ["*"]
4943 update-types : ["minor", "patch"]
5044 open-pull-requests-limit : 10
5145 assignees : ["mrz1836"]
@@ -62,8 +56,8 @@ updates:
6256 target-branch : " master"
6357 schedule :
6458 interval : " weekly"
65- day : " monday "
66- time : " 09 :15"
59+ day : " tuesday "
60+ time : " 11 :15"
6761 timezone : " America/New_York"
6862 allow :
6963 - dependency-type : " direct"
@@ -85,8 +79,8 @@ updates:
8579 target-branch : " master"
8680 schedule :
8781 interval : " weekly"
88- day : " monday "
89- time : " 09 :30"
82+ day : " tuesday "
83+ time : " 11 :30"
9084 timezone : " America/New_York"
9185 allow :
9286 - dependency-type : " direct"
0 commit comments