Grouping Dependabot Security Updates NPM

[DrillableBit]

Select Topic Area

Question

Body

Hi,
Am I understanding the dependabot docs correctly that the following code will group the directory's security updates into a group?
The following .yaml appears to group ALL updates in a PR, but it doesn't seem PR security updates?

version: 2
updates:

  - package-ecosystem: npm
    directory: "/frontend"
    schedule:
      interval: daily
    open-pull-requests-limit: 10
    groups:
      security-updates:
        applies-to: security-updates
        patterns:
          - "*"

[borj404]

[DrillableBit]

Thank you! I've implemented the configuration, but dependabot does not seem to have created a PR yet. I'll keep you posted on if it works

[DrillableBit]

Hmm, I've tried:

`

version: 2
updates:

Security updates

• package-ecosystem: "npm"
  directory: "/frontend"
  schedule:
  interval: "daily"
  open-pull-requests-limit: 10
  security-updates:
  enabled: true
  groups:
  security-updates:
  patterns:
  - "*" # Group security updates into a PR

`

But I get the error:

The property '#/updates/1/' contains additional properties ["security-updates"] outside of the schema when none are allowed

I get:

The property '#/updates/1/' contains additional properties ["applies-to"] outside of the schema when none are allowed

If I try to use applies-to instead.

[borj404]

My bad, it appears that in this version there is no direct method to isolate security-only updates in the dependabot.yml file. Security updates can be enabled and configured through the GitHub Security Settings for the repository, but this process is separate from the dependabot configuration. https://stackoverflow.com/questions/64047526/how-to-get-dependabot-to-trigger-for-security-updates-only

[DrillableBit]

Do you know of any associated dangers of downgrading?

It feels kind of odd to remove IaC-features from a product.

[borj404]

Since these features were integrated into the Security settings for direct control and management, it seems this is why they were removed from the dependabot file...
And yes, downgrading could lead to risks such as security vulnerabilities or missing bug fixes. It could also potentially cause functional issues, such as compatibility problems or the loss of features if the version isn't fully supported with current dependencies.