# Please see the documentation for all configuration options:
# https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/" # Location of package manifests
    open-pull-requests-limit: 0 # only require security updates and exclude version updates
    schedule:
      interval: "weekly"
    # For got, ignore all updates since it is now native ESM
    # see https://github.com/hashicorp/vault-action/pull/457#issuecomment-1601445634
    ignore:
      - dependency-name: "got"