[nealrichardson]

Closes #1135

Adds .github/dependabot.yml with weekly updates for:

• npm: one entry at the root, which covers every Yarn v1 workspace (apps/*, packages/*, packages/ojs/*). Minor and patch bumps are grouped into one PR; major bumps get separate PRs. At most 10 open PRs at a time.
• GitHub Actions: all updates grouped into one PR, which keeps the actions updated after ci: pin GitHub Actions to commit SHAs, fix Node 20 deprecation #1129.

Deliberate exceptions:

• @types/vscode is ignored. It's pinned to 1.75.0 to match engines.vscode, and bumping it would let code use newer VS Code APIs and quietly raise the minimum supported VS Code version.
• @types/node major bumps are ignored. The version tracks the Node runtime each package runs on.

Security-only Dependabot PRs are turned on separately in repo Settings → Code security.

🤖 Generated with Claude Code

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[vezwork]

@nealrichardson some context:

I've made at least one attempt (see comment thread with author of library) to update some of our dependencies in the past but it is complicated by yarn problems and the monorepo structure. I tried another time or two, but can't seem to find the PRs right now, maybe they were only branches.

Also, I notice that Snyk makes PRs (for example) to update dependencies but I haven't attempted to tackle those.

My understanding is that dependabot will make similar, but more aggregated, PRs to update dependencies? Perhaps this would nicer than the Snyk PRs? But should we disable the Snyk PRs in that case?

Overall, the root cause of dependencies not being updated is problems with yarn and the monorepo. I will, at some point, take some time to make another attempt to resolve those problems (probably by migrating the monorepo to npm), but in the meantime I think I will have to ignore these PRs.

That being said, probably not all dependency upgrades are blocked by these issues, just the ones I was trying to update previously. I could prioritize attempting to burn down some particular upgrades if that would be impactful?

[nealrichardson]

But should we disable the Snyk PRs in that case?

Yes I plan to do that. IME they haven't been high quality in other projects I've seen them on.

Overall, the root cause of dependencies not being updated is problems with yarn and the monorepo. I will, at some point, take some time to make another attempt to resolve those problems, but in the meantime I think I will have to ignore these PRs.

That being said, probably not all dependency upgrades are blocked by these issues, just the ones I was trying to update previously. I could prioritize attempting to burn down some simpler upgrades if that would be impactful?

Surely it is possible with an LLM to break through the "problems with yarn and the monorepo"?

[vezwork]

sorry I accidentally edited your comment instead of posting this one, I reverted my edit.

Surely it is possible with an LLM to break through the "problems with yarn and the monorepo"?

I made a half-day attempt some months ago, but it got stuck going in loops that I didn't know how to break out of. Probably more possible nowadays?

[nealrichardson]

I am firing off some PRs to update all of the dependencies, then that should make it cleaner to switch to npm, and then we can turn this on.

[nealrichardson]

Closing for now; we'll revisit once the dependency upgrade work is done (note the @types/vscode pin is now 1.101 after #1157).