dependabot.yml

# Copied from https://docs.github.com/en/github/administering-a-repository/enabling-and-disabling-version-updates#enabling-github-dependabot-version-updates
# Basic dependabot.yml file with minimum configuration for two package managers
# Configuration options: https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates

version: 2
updates:
  # To reduce noise, CURRENTLY DISABLED non-critical-security updates until the repo is more maintained again
  #
  ## Enable version updates for npm
  #- package-ecosystem: "npm"
  #  # Look for `package.json` and `lock` files in the `root` directory
  #  directory: "/"
  #  # Check the npm registry for updates once a week
  #  schedule:
  #    interval: "weekly"
  #  # Limit the amout of open PR's (default = 5, disabled = 0, security updates are not impacted)
  #  open-pull-requests-limit: 5
  #
  #Since we use the lts-alpine image in the Dockerfile this is currently not needed
  # # Enable version updates for Docker
  #- package-ecosystem: "docker"
  #  # Look for a `Dockerfile` in the `root` directory
  #  directory: "/"
  #  # Check for updates once a week
  #  schedule:
  #    interval: "weekly"
  #  # Limit the amout of open PR's (default = 5, disabled = 0, security updates are not impacted)
  #  open-pull-requests-limit: 1

  # Enable version updates for GitHub Actions
  - package-ecosystem: "github-actions"
    # Directory must be set to "/" to check for workflow files in .github/workflows
    directory: "/"
    schedule:
      # Check for updates to GitHub Actions once a week
      interval: "weekly"
    # Limit the amout of open PR's (default = 5, disabled = 0, security updates are not impacted)
    open-pull-requests-limit: 2