dependabot.yml

version: 2
updates:
  # Dependencies in our CI
  - package-ecosystem: github-actions
    # Workflow files stored in the default location of `.github/workflows`. (You
    # don't need to specify `/.github/workflows` for `directory`. You can use
    # `directory: "/"`.)
    directory: /
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(ci)
      prefix-development: deps(ci)

  # Dependencies in our packages

  - package-ecosystem: npm
    directory: /
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    open-pull-requests-limit: 20
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps
      prefix-development: deps(dev)
    ignore:
      # Ignore updates to the @types/node package due to conflict between
      # Headers in DOM.
      - dependency-name: "@types/node"
        versions: [">18.18"]
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]
      # Ignore updates for Buf and ConnectRPC v2 and above
      - dependency-name: "@bufbuild/protobuf"
        versions: [">=2"]
      - dependency-name: "@connectrpc/connect"
        versions: [">=2"]
      - dependency-name: "@connectrpc/connect-node"
        versions: [">=2"]
      - dependency-name: "@connectrpc/connect-web"
        versions: [">=2"]

  # Dependencies in our examples

  # Bun isn't supported by Dependabot
  # Ref: https://github.com/dependabot/dependabot-core/issues/6528
  # - package-ecosystem: npm
  #   directory: /examples/bun-hono-rate-limit
  #   schedule:
  #     # Our dependencies should be checked daily
  #     interval: daily
  #   assignees:
  #     - blaine-arcjet
  #   reviewers:
  #     - blaine-arcjet
  #   commit-message:
  #     prefix: deps(example)
  #     prefix-development: deps(example)
  #   groups:
  #     dependencies:
  #       patterns:
  #         - "*"

  # Bun isn't supported by Dependabot
  # Ref: https://github.com/dependabot/dependabot-core/issues/6528
  # - package-ecosystem: npm
  #   directory: /examples/bun-rate-limit
  #   schedule:
  #     # Our dependencies should be checked daily
  #     interval: daily
  #   assignees:
  #     - blaine-arcjet
  #   reviewers:
  #     - blaine-arcjet
  #   commit-message:
  #     prefix: deps(example)
  #     prefix-development: deps(example)
  #   groups:
  #     dependencies:
  #       patterns:
  #         - "*"

  # Deno isn't supported by Dependabot
  # Ref: https://github.com/dependabot/dependabot-core/issues/2417
  # - package-ecosystem: deno
  #   directory: /examples/deno-sensitive-info
  #   schedule:
  #     # Our dependencies should be checked daily
  #     interval: daily
  #   assignees:
  #     - blaine-arcjet
  #   reviewers:
  #     - blaine-arcjet
  #   commit-message:
  #     prefix: deps(example)
  #     prefix-development: deps(example)
  #   groups:
  #     dependencies:
  #       patterns:
  #         - "*"

  - package-ecosystem: npm
    directory: /examples/express-bots
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"

  - package-ecosystem: npm
    directory: /examples/express-newman
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"

  - package-ecosystem: npm
    directory: /examples/express-sensitive-info
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"

  - package-ecosystem: npm
    directory: /examples/nestjs
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # NestJS uses Express 4
      - dependency-name: "@types/express"
        versions: [">=5"]
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]

  - package-ecosystem: npm
    directory: /examples/nestjs-fastify
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]

  - package-ecosystem: npm
    directory: /examples/nestjs-graphql
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # NestJS uses Express 4
      - dependency-name: "@types/express"
        versions: [">=5"]
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]

  - package-ecosystem: npm
    directory: /examples/nestjs-launchdarkly
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # NestJS uses Express 4
      - dependency-name: "@types/express"
        versions: [">=5"]
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]

  - package-ecosystem: npm
    directory: /examples/nextjs-14-nextauth-4
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # Ignore updates to the @types/node package due to conflict between
      # Headers in DOM.
      - dependency-name: "@types/node"
        versions: [">18.18"]
      # NextAuth 4 doesn't support Next.js 15+ so the dependencies below are
      # restricted.
      - dependency-name: next
        versions: [">=15"]
      - dependency-name: react
        versions: [">=19"]
      - dependency-name: "@types/react"
        versions: [">=19"]
      - dependency-name: react-dom
        versions: [">=19"]
      - dependency-name: "@types/react-dom"
        versions: [">=19"]
      - dependency-name: eslint
        versions: [">=9"]
      - dependency-name: eslint-config-next
        versions: [">=15"]

  - package-ecosystem: npm
    directory: /examples/nextjs-app-dir-rate-limit
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # Ignore updates to the @types/node package due to conflict between
      # Headers in DOM.
      - dependency-name: "@types/node"
        versions: [">18.18"]
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]

  - package-ecosystem: npm
    directory: /examples/nextjs-app-dir-validate-email
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # Ignore updates to the @types/node package due to conflict between
      # Headers in DOM.
      - dependency-name: "@types/node"
        versions: [">18.18"]
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]

  - package-ecosystem: npm
    directory: /examples/nextjs-authjs-5
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # Ignore updates to the @types/node package due to conflict between
      # Headers in DOM.
      - dependency-name: "@types/node"
        versions: [">18.18"]
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]

  - package-ecosystem: npm
    directory: /examples/nextjs-authjs-nosecone
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # Ignore updates to the @types/node package due to conflict between
      # Headers in DOM.
      - dependency-name: "@types/node"
        versions: [">18.18"]
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]

  - package-ecosystem: npm
    directory: /examples/nextjs-bot-categories
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # Ignore updates to the @types/node package due to conflict between
      # Headers in DOM.
      - dependency-name: "@types/node"
        versions: [">18.18"]
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]

  - package-ecosystem: npm
    directory: /examples/nextjs-clerk-rate-limit
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # Ignore updates to the @types/node package due to conflict between
      # Headers in DOM.
      - dependency-name: "@types/node"
        versions: [">18.18"]
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]

  - package-ecosystem: npm
    directory: /examples/nextjs-clerk-shield
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # Ignore updates to the @types/node package due to conflict between
      # Headers in DOM.
      - dependency-name: "@types/node"
        versions: [">18.18"]
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]

  - package-ecosystem: npm
    directory: /examples/nextjs-decorate
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # Ignore updates to the @types/node package due to conflict between
      # Headers in DOM.
      - dependency-name: "@types/node"
        versions: [">18.18"]
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]

  - package-ecosystem: npm
    directory: /examples/nextjs-ip-details
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # Ignore updates to the @types/node package due to conflict between
      # Headers in DOM.
      - dependency-name: "@types/node"
        versions: [">18.18"]
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]

  - package-ecosystem: npm
    directory: /examples/nextjs-openai
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # Ignore updates to the @types/node package due to conflict between
      # Headers in DOM.
      - dependency-name: "@types/node"
        versions: [">18.18"]
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]

  - package-ecosystem: npm
    directory: /examples/nextjs-pages-wrap
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # Ignore updates to the @types/node package due to conflict between
      # Headers in DOM.
      - dependency-name: "@types/node"
        versions: [">18.18"]
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]

  - package-ecosystem: npm
    directory: /examples/nextjs-permit
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # Ignore updates to the @types/node package due to conflict between
      # Headers in DOM.
      - dependency-name: "@types/node"
        versions: [">18.18"]
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]

  - package-ecosystem: npm
    directory: /examples/nextjs-react-hook-form
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # Ignore updates to the @types/node package due to conflict between
      # Headers in DOM.
      - dependency-name: "@types/node"
        versions: [">18.18"]
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]

  - package-ecosystem: npm
    directory: /examples/nextjs-sensitive-info
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # Ignore updates to the @types/node package due to conflict between
      # Headers in DOM.
      - dependency-name: "@types/node"
        versions: [">18.18"]
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]

  - package-ecosystem: npm
    directory: /examples/nextjs-server-actions
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # Ignore updates to the @types/node package due to conflict between
      # Headers in DOM.
      - dependency-name: "@types/node"
        versions: [">18.18"]
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]
      # Ignore React during the `rc` period
      - dependency-name: react
        versions: ["*"]
      - dependency-name: react-dom
        versions: ["*"]

  - package-ecosystem: npm
    directory: /examples/nodejs-express-launchdarkly
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"

  - package-ecosystem: npm
    directory: /examples/nodejs-express-rate-limit
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"

  - package-ecosystem: npm
    directory: /examples/nodejs-express-validate-email
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"

  - package-ecosystem: npm
    directory: /examples/nodejs-hono-rate-limit
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"

  - package-ecosystem: npm
    directory: /examples/nodejs-rate-limit
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"

  - package-ecosystem: npm
    directory: /examples/remix-express
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]
      # Remix 2 doesn't support Vite 6 or React 19 so the dependencies below are
      # restricted.
      - dependency-name: vite
        versions: [">=6"]
      - dependency-name: react
        versions: [">=19"]
      - dependency-name: "@types/react"
        versions: [">=19"]
      - dependency-name: react-dom
        versions: [">=19"]
      - dependency-name: "@types/react-dom"
        versions: [">=19"]

  - package-ecosystem: npm
    directory: /examples/sveltekit
    schedule:
      # Our dependencies should be checked daily
      interval: daily
    assignees:
      - blaine-arcjet
      - e-moran
    reviewers:
      - blaine-arcjet
      - e-moran
    commit-message:
      prefix: deps(example)
      prefix-development: deps(example)
    groups:
      dependencies:
        patterns:
          - "*"
    ignore:
      # TODO(#539): Upgrade to eslint 9
      - dependency-name: eslint
        versions: [">=9"]