build(deps): consolida as atualizações pendentes do Dependabot

.github/dependabot.yml

@@ -1,40 +1,29 @@
 version: 2
 updates:
-  # Dependências do npm. Menores e patches chegam agrupados num PR por semana
-  # para não virar ruído. Majors dos frameworks congelados (Vue 2 / Vuetify 1.5)
-  # ficam de fora: migrar é uma decisão, não uma atualização.
+  # Dependências do npm: uma rodada por mês, tudo agrupado. Majors ficam de
+  # fora: a base está congelada em Vue 2 / Vuetify 1.5 / webpack 4 / Node 14,
+  # e um major aqui é migração, não atualização.
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
+      interval: "monthly"
+    open-pull-requests-limit: 2
     groups:
-      minor-e-patch:
+      atualizacoes:
+        applies-to: version-updates
         update-types: ["minor", "patch"]
+      seguranca:
+        applies-to: security-updates
+        patterns: ["*"]
     ignore:
-      - dependency-name: "vue"
-        update-types: ["version-update:semver-major"]
-      - dependency-name: "vuetify"
-        update-types: ["version-update:semver-major"]
-      - dependency-name: "vuex"
-        update-types: ["version-update:semver-major"]
-      - dependency-name: "vue-router"
-        update-types: ["version-update:semver-major"]
-      - dependency-name: "vue-template-compiler"
-        update-types: ["version-update:semver-major"]
-      - dependency-name: "@vue/*"
-        update-types: ["version-update:semver-major"]
-      # vue-i18n 9+ só roda em Vue 3.
-      - dependency-name: "vue-i18n"
-        update-types: ["version-update:semver-major"]
-      # Toolchain presa ao webpack 4 / vue-cli 4 e ao Node 14 do CI.
-      - dependency-name: "prettier"
-        update-types: ["version-update:semver-major"]
-      - dependency-name: "stylus-loader"
+      - dependency-name: "*"
         update-types: ["version-update:semver-major"]
 
-  # Actions usadas nos workflows (checkout, setup-node etc.).
+  # Actions usadas nos workflows: um PR por mês com todas.
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "monthly"
+    groups:
+      actions:
+        patterns: ["*"]

.github/workflows/analysis.yml

@@ -39,11 +39,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -54,7 +54,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+      uses: github/codeql-action/autobuild@v4
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -68,4 +68,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4

.github/workflows/tests.yml

@@ -11,8 +11,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-node@v4
+    - uses: actions/checkout@v7
+    - uses: actions/setup-node@v7
       with:
         node-version: '14'
     - run: npm install