version: 2
updates:
- package-ecosystem: github-actions
  directory: "/"
  schedule:
    interval: daily
  open-pull-requests-limit: 10
- package-ecosystem: gomod
  directory: "/"
  schedule:
    interval: daily
  open-pull-requests-limit: 10
- package-ecosystem: npm
  directory: "/web"
  schedule:
    interval: weekly
  open-pull-requests-limit: 10

version: 2
updates:
- package-ecosystem: github-actions
  directory: "/"
  schedule:
    interval: daily
  open-pull-requests-limit: 10
- package-ecosystem: gomod
  directory: "/"
  schedule:
    interval: daily
  open-pull-requests-limit: 10
- package-ecosystem: npm
  directory: "/web"
  versioning-strategy: lockfile-only
  schedule:
    interval: weekly
  open-pull-requests-limit: 10

Switch Dependabot for npm to only manage the lock file
Switch Dependabot for npm to only manage the lock file

This will preserve package.json and keep the lockfile inline with the
semver ranges defined by package.json. Dependabot will no longer suggest
version bumps that fall outside of the specified semver range.

https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates#versioning-strategy

Signed-off-by: Scott Andrews <3c3f88d1eb2a159b74dde1f6a188e69f8e46fb68@vmware.com>
