misc: add dependabot.yml

[connorjclark]

See https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file

There is no way to exclude certain subfolders (like legacy-javascript package.json). See dependabot/dependabot-core#4364 . But we could at least move all those deps into devDeps which should exclude them from updates.

[adamraine]

Should we do the same for other random package.json? e.g.: https://github.com/GoogleChrome/lighthouse/blob/main/docs/recipes/auth/package.json

[connorjclark]

No, those are arguably security sensitive (we tell people to use them as examples) so should get updates.

[brendankenny]

"security"

[adamraine]

No, those are arguably security sensitive (we tell people to use them as examples) so should get updates.

Then should we change the docs ones that use devDependencies
https://github.com/GoogleChrome/lighthouse/blob/main/docs/recipes/type-checking/package.json
https://github.com/GoogleChrome/lighthouse/blob/main/docs/recipes/lighthouse-plugin-example/package.json

[connorjclark]

Idk, let's not overfit this thing and just continue to use what we thought best for these examples

[paulirish]

good catch