j40-cejst-2/.github/dependabot.yml

# It's unclear whether this configuration is supported for stopping dev only
# security issues, see https://github.com/usds/justice40-tool/issues/1121 and
# https://github.com/dependabot/dependabot-core/issues/2521.
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/**"
    schedule:
      interval: "daily"
    allow:
      - dependency-type: "production"
Document current dependabot issues in config file Fixes: https://github.com/usds/justice40-tool/issues/1121 It's unclear whether this file is doing what we want it to do. This is an open issue in the dependabot repo. Added a comment to document the current status of what's going on here. If these keep coming up (which they probably will), we might either want to disable dependabot or document a quick workflow for verifying this is a dev only issue (https://github.com/usds/justice40-tool/issues/1121 might be that documentation). 2022-01-11 12:00:07 -05:00			`# It's unclear whether this configuration is supported for stopping dev only`
			`# security issues, see https://github.com/usds/justice40-tool/issues/1121 and`
			`# https://github.com/dependabot/dependabot-core/issues/2521.`
Silence dev only vulnerabilities (#1041) Showing obscure vulnerabilities that only exist in the dev setup creates more noise and means that they just get ignored (because they are probably low priority). Silencing them means when we get a vulnerable dependency alert we know to pay attention to it. Comes from https://github.com/dependabot/dependabot-core/issues/2521 and https://github.com/hpcc-systems/Tombolo/commit/501bbef57817a9a46498095fdbd2e1e7a6ce62fa. 2021-12-13 13:54:59 -05:00			`version: 2`
			`updates:`
			`- package-ecosystem: "npm"`
			`directory: "/**"`
			`schedule:`
			`interval: "daily"`
			`allow:`
			`- dependency-type: "production"`