Add Dependabot for npm, Docker and Actions - #5
Conversation
RayMail parses untrusted input from the public internet, so an unpatched dependency is a live risk rather than housekeeping. Co-authored-by: abbera <203441866+abbera@users.noreply.github.com>
|
Warning Review limit reachedNext included review available in 6 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
🟢 Approval recommended
The Dependabot configuration is valid for the existing /web npm and Docker setup and should enable the intended update cadence without code behavior changes.
Pull request overview
Adds a Dependabot configuration to automate dependency updates across the repository, aligning with the goal of regularly updating the /web Node dependencies, the /web Docker base image, and GitHub Actions workflows.
Changes:
- Configure weekly Dependabot updates for the npm ecosystem in
/web. - Configure weekly Dependabot updates for Docker dependencies (base images) in
/web. - Configure monthly Dependabot updates for GitHub Actions workflows at the repo root.
File summaries
| File | Description |
|---|---|
| .github/dependabot.yml | Introduces Dependabot schedules and labels for npm, Docker, and GitHub Actions updates. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Weekly npm and base-image checks, monthly Actions bumps. Co-authored with @abbera.