fix: add Dependabot coverage for webapp/backend and webapp/frontend
Open
@danielmeppiel is already working on this.
Since Apr 1, 2026.
- #104 by @copilot-swe-agent — closed without merging
bug
- Dominant language
- TypeScript
- Stars
- 1.1k
- Forks
- 94
- Avg merge
- 8d 3h
- Merged PRs (30d)
- 7
Description
The dependabot.yml config monitors / and /vscode-extension for npm updates, but webapp/backend and webapp/frontend are not covered. Their package-lock.json files will not receive automated vulnerability PRs.
Fix
Add to .github/dependabot.yml:
- package-ecosystem: npm
directory: /webapp/backend
schedule:
interval: weekly
open-pull-requests-limit: 5
groups:
dev-dependencies:
dependency-type: development
production-dependencies:
dependency-type: production
- package-ecosystem: npm
directory: /webapp/frontend
schedule:
interval: weekly
open-pull-requests-limit: 5
groups:
dev-dependencies:
dependency-type: development
Context
Introduced by PR #90 (webapp). The webapp ships Express, Helmet, and other production dependencies that need vulnerability monitoring.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.