Skip to content

Automated npm dependency updates

Problem

Dependabot only covered GitHub Actions. npm dependencies were manually updated, risking stale packages with known vulnerabilities and missing performance/security patches.

Proposal

Extend .github/dependabot.yml to include package-ecosystem: npm with:

  • Weekly schedule
  • Grouped updates: dev deps (minor+patch) and prod deps (patch) in separate PRs
  • Ignore framework-level deps managed via root overrides (react, next, typescript, plus zod, tailwindcss, vitest)
  • 10 open PR limit to avoid PR flood

Acceptance criteria

  • .github/dependabot.yml includes npm ecosystem
  • Dev dependency minor/patch updates grouped
  • Production dependency patch updates grouped
  • React, Next.js, TypeScript excluded (managed via overrides)
  • Open PR limit set to 10

Out of scope

  • Auto-merge for patch updates (requires branch protection rule changes)
  • Renovate evaluation (Dependabot is sufficient for current scale)
  • npm audit CI step (existing npm install warnings surface vulnerabilities)

Notes / decisions log

  • 2026-07-07: Proposed. Dependabot remains preferred over Renovate for simplicity because GH Actions updates already run there. Major version bumps should remain individual PRs for deliberate review.
  • 2026-07-09: Deferred — moved to tickets/deferred/; no active implementation planned.
  • 2026-08-03: Implemented. npm ecosystem added to .github/dependabot.yml with weekly schedule, grouped dev (minor+patch) and prod (patch) updates, open-pull-requests-limit: 10, and ignore list for override-managed stacks (react, react-dom, next, typescript, zod, tailwindcss, vitest). Ticket moved out of deferred/.