Enable Dependabot Version Updates

[JamieBort]

Enable Dependabot Version Updates

This issue is in reference to this Dependabot version updates feature in the https://github.com/JamieBort/Personal-Dashboard/settings/security_analysis page.

Resources

• Keep all your packages up to date with Dependabot GitHub blog post

  Keeping your dependencies updated is one of the easiest ways to keep the software you build secure. However, while it’s critically important to keep your dependencies updated, in a recent…

  This one was a help.

• Documentation
  Configuring Dependabot version updates

  You can configure your repository so that Dependabot automatically updates the packages you use.

• A potential source:
  https://trello.com/c/7xQFGezu/1319-address-these-dependabot-alerts

• Another potential source:
  https://github.com/JamieBort/LearningDirectory/tree/master/Git/security#dependabot

Potential yml file

# To get started with Dependabot version updates, you'll need to specify which
# package ecosystems to update and where the package manifests are located.
# Please see the documentation for all configuration options:
# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file

version: 2
updates:
  - package-ecosystem: "yarn" # See documentation for possible values
    directory: "/frontend" # Location of package manifests
    schedule:
      interval: "monthly"
  - package-ecosystem: "yarn" # See documentation for possible values
    directory: "/backend" # Location of package manifests
    schedule:
      interval: "monthly"

Todo

• Finish setting up this Issue. To that end, see Enable Dependabot Version Updates Portfolio-Website#17 for wording, formatting, process, screenshots, etc.
• Research what needs to be done.
• Enable this feature.

Status

Done.

I referred to

• this Keep all your packages up to date with Dependabot GitHub blog post
• and this Enable Dependabot Version Updates Portfolio-Website#17

to accomplish this task.

However, I may need to go back into settings to manually enable the feature. To that end, see this message below.

[JamieBort]

Added this

# To get started with Dependabot version updates, you'll need to specify which
# package ecosystems to update and where the package manifests are located.
# Please see the documentation for all configuration options:
# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file

version: 2
updates:
  - package-ecosystem: "yarn" # See documentation for possible values
    directory: "/frontend" # Location of package manifests
    schedule:
      interval: "monthly"
  - package-ecosystem: "yarn" # See documentation for possible values
    directory: "/backend" # Location of package manifests
    schedule:
      interval: "monthly"

to this .github/dependabot.yml file in the fullstack branch.

See commit af07e52

This feature should be enabled once the master branch has this .github/dependabot.yml file.

If not, return to this settings page and select Enable next to the Dependabot version updates feature.