[nealrichardson]

Turns on Dependabot version updates now that the repo is on npm (#1196).

Changes

New .github/dependabot.yml with one npm entry at /, which covers every workspace through the root package-lock.json:

• Schedule: weekly, with a 7-day cooldown (cooldown.default-days: 7), so a release has to be a week old before it's proposed.
• Grouping: all minor and patch updates go into one npm-minor-and-patch PR. Each major update gets its own PR.
• versioning-strategy: increase: raises the floor in every workspace that declares the package, so ranges stay unified, as the upgrade PRs did by hand.
• Commit prefix build, to match the repo's build: … PR titles. open-pull-requests-limit: 10.
• Ignored, because they're held back on purpose:
  • @types/vscode: all updates. It has to match engines.vscode (^1.101.0).
  • @types/node: majors. It stays on 22, the Node of the oldest supported extension host.
  • which: 7 and later, which needs Node ≥22.22. 4–6 are allowed.
  • mocha: majors. @vscode/test-cli 0.0.15 doesn't support mocha 12.
  • typescript: 6.1 and later. typescript-eslint caps its peer range at <6.1, and TS 7 has no JS API yet.
  • markdown-it-attrs: majors. 5.x calls require('markdown-it'), which bundles a second markdown-it.
  • prettier: majors. Prettier 3 comes with a repo-wide reformat.
  • mermaid: all updates. It must be the exact version of the diagram preview's vendored mermaid.min.js (mermaidVersion.test.ts), and it should follow quarto-cli.

GitHub Actions updates aren't included.

Verification

• check-jsonschema --builtin-schema vendor.dependabot passes.
• The real check is the first run after merge: the Insights → Dependency graph → Dependabot tab shows whether the config parsed and what each job did.

🤖 Generated with Claude Code

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[juliasilge]

Let's give it a go!