From 64f9ddc6eb6ca52d9fe827eae258eaf71e399b0e Mon Sep 17 00:00:00 2001
From: Guanzhou Song <guanzhou.song@gmail.com>
Date: Thu, 30 Jul 2026 10:09:40 -0400
Subject: [PATCH] Add Dependabot configuration for automated dependency updates

Enables weekly version updates for the three ecosystems in this repo:

- npm, for the Next.js site
- bundler, for the Jekyll toolchain that builds the blogs section
- github-actions, for the actions pinned in our workflows

Routine minor and patch bumps are grouped into a single PR per ecosystem
to keep review load low. Major bumps still arrive as individual PRs so
each can be evaluated on its own. The npm entry uses
`versioning-strategy: increase-if-necessary`, so in-range updates stay
confined to package-lock.json and package.json is only modified when a
bump genuinely requires a wider range.

There is a practical reason to prefer this over updating lockfiles by
hand. Dependency resolution on a contributor machine behind a corporate
registry proxy rewrites every `resolved` URL in package-lock.json to the
proxy's backing feed, which is not reachable from public CI or by
outside contributors. Dependabot runs on GitHub's infrastructure and
resolves against the public npm registry directly, so `resolved` URLs
stay canonical no matter how any individual contributor has npm
configured locally.

Note that this file enables version updates only. Dependabot security
updates, which open PRs for advisories ahead of the weekly schedule, are
a separate repository setting under Settings > Code security and need to
be turned on by a maintainer with admin access.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WWCBtvyCpxc2aqtyLDhDeE
---
 .github/dependabot.yml | 61 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..e901cda
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,61 @@
+# Automated dependency updates.
+#
+# Dependabot runs on GitHub's infrastructure, so lockfile updates always
+# resolve against the public npm registry. This keeps `resolved` URLs in
+# package-lock.json canonical regardless of any registry proxy a
+# contributor may have configured locally.
+version: 2
+updates:
+  # Next.js site dependencies
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    # Only touch package.json when a bump requires it; in-range updates
+    # stay confined to package-lock.json.
+    versioning-strategy: increase-if-necessary
+    commit-message:
+      prefix: npm
+      include: scope
+    groups:
+      # Batch routine minor/patch bumps into a single PR to keep the
+      # review load low. Majors still arrive as individual PRs so each
+      # one can be evaluated on its own.
+      npm-minor-and-patch:
+        update-types:
+          - minor
+          - patch
+
+  # Jekyll toolchain for the blogs section
+  - package-ecosystem: bundler
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: bundler
+      include: scope
+    groups:
+      bundler-minor-and-patch:
+        update-types:
+          - minor
+          - patch
+
+  # Workflow actions (actions/checkout, actions/setup-node, ...)
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: actions
+    groups:
+      github-actions:
+        update-types:
+          - major
+          - minor
+          - patch