[StepSecurity] Apply security best practices

[step-security-bot]

Summary

This pull request is created by StepSecurity at the request of @AugustinMauroy. Please merge the Pull Request to incorporate the requested changes. Please tag @AugustinMauroy on your message if you have any questions related to the PR.

Security Fixes

Keeping your actions up to date with Dependabot

With Dependabot version updates, when Dependabot identifies an outdated dependency, it raises a pull request to update the manifest to the latest version of the dependency. This is recommended by GitHub as well as The Open Source Security Foundation (OpenSSF).

• GitHub Security Guide
• The Open Source Security Foundation (OpenSSF) Security Guide

Feedback

For bug reports, feature requests, and general feedback; please email [email protected]. To create such PRs, please visit https://app.stepsecurity.io/securerepo.

Signed-off-by: StepSecurity Bot [email protected]

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Updated (UTC)
nodejs-org	✅ Ready (Inspect)	Visit Preview	Nov 23, 2024 9:36am

[AugustinMauroy]

It's not solve this issue idk why we have this error

[bmuenzenmeyer]

we dont want daily updates do we??? earlier elements of our config indicate we do this monthly

[bmuenzenmeyer]

i'd probably move to close - I like this tool but I think we have this guidance handled already

[AugustinMauroy]

i'd probably move to close - I like this tool but I think we have this guidance handled already

It's anoying you cannot have a preview of changes

[bmuenzenmeyer]

It's anoying you cannot have a preview of changes

we know what this is doing. it's completely ignoring all of our configuration and adding new config at the bottom, running EVERY dependency independently, without grouping, daily

  - package-ecosystem: npm
    directory: /apps/site
    schedule:
      interval: daily

  - package-ecosystem: npm
    directory: /packages/i18n
    schedule:
      interval: daily

this is not better than what we have today

[AugustinMauroy]

i definitely allow with you

[varunsh-coder]

Hi @AugustinMauroy thanks for using StepSecurity to create this PR.

I wanted to mention why the tool added those sections. It is because the current dependabot config only applies to the root package.json file and will not update dependencies in the package.json files in the /apps/site and /packages/i18n directories. Please let me know if you think otherwise.

Also, you can preview changes when using the tool before creating a PR (screenshot below).

Please let me know if you have any questions/ comments. Happy to help and discuss any improvement ideas.

[AugustinMauroy]

How wow I didn't know that that super cool ! Thanks

[bmuenzenmeyer]

What? This is the history of the apps/site package.json