From 9b64f0464b7b8aaf4c312a21f3214e44da97a7ae Mon Sep 17 00:00:00 2001
From: Sandeep Das <sandeepdasnitrkl@gmail.com>
Date: Wed, 19 Aug 2026 22:34:39 +0530
Subject: [PATCH 1/2] Add Dependabot version updates config for AdaptiveCards
 ecosystems

Adds .github/dependabot.yml covering all package managers in the repo:
- npm: /, /schemas, and the /source/nodejs lerna + npm-workspaces monorepo
- nuget: dotnet, uwp, winui3 solution roots and the iOS feed tool
- gradle: /source/android
- swift: Package.swift at repo root
- github-actions: workflows

Weekly schedule, PR limit 1 per ecosystem. CocoaPods (iOS Podfile) is
omitted as it is not a Dependabot-supported ecosystem.
---
 .github/dependabot.yml | 63 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000000..9fbc276a89
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,63 @@
+version: 2
+updates:
+  # ---- JavaScript / TypeScript (npm) ----
+  # /source/nodejs is a lerna + npm-workspaces monorepo; its single lockfile
+  # covers every workspace package (adaptivecards, -templating, -react, etc.).
+  - package-ecosystem: "npm"
+    directories:
+      - "/"
+      - "/schemas"
+      - "/source/nodejs"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 1
+    labels:
+      - "dependencies"
+      - "javascript"
+
+  # ---- .NET (NuGet) ----
+  # Target the concrete solution roots (each has its own .sln that references
+  # its projects) rather than broad "**" globs, which the Dependabot guidance
+  # warns can be slow / time out for NuGet.
+  - package-ecosystem: "nuget"
+    directories:
+      - "/source/dotnet"
+      - "/source/uwp"
+      - "/source/uwp/winui3"
+      - "/source/ios/tools/IOSFeed"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 1
+    labels:
+      - "dependencies"
+      - "dotnet"
+
+  # ---- Android (Gradle) ----
+  - package-ecosystem: "gradle"
+    directory: "/source/android"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 1
+    labels:
+      - "dependencies"
+      - "android"
+
+  # ---- Swift Package Manager (Package.swift at repo root) ----
+  - package-ecosystem: "swift"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 1
+    labels:
+      - "dependencies"
+      - "swift"
+
+  # ---- GitHub Actions workflows ----
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 1
+    labels:
+      - "dependencies"
+      - "github-actions"

From e37fbdd3177f3b4c81f4b022b3ec788d5347ba74 Mon Sep 17 00:00:00 2001
From: Sandeep Das <sandeepdasnitrkl@gmail.com>
Date: Wed, 19 Aug 2026 22:55:57 +0530
Subject: [PATCH 2/2] Scope npm updates to /source/nodejs (real manifest root)

Repo-root and /schemas package-lock.json are empty stubs with no
package.json, so Dependabot's npm updater would error there. The only
real npm root is the /source/nodejs workspaces monorepo, whose single
top-level manifest + lockfile covers all workspace packages.
---
 .github/dependabot.yml | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9fbc276a89..04202da39e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,13 +1,12 @@
 version: 2
 updates:
   # ---- JavaScript / TypeScript (npm) ----
-  # /source/nodejs is a lerna + npm-workspaces monorepo; its single lockfile
-  # covers every workspace package (adaptivecards, -templating, -react, etc.).
+  # /source/nodejs is a lerna + npm-workspaces monorepo; its single top-level
+  # package.json + lockfile covers every workspace package (adaptivecards,
+  # -templating, -react, etc.). The repo-root and /schemas lockfiles are empty
+  # stubs with no package.json, so they are intentionally not listed.
   - package-ecosystem: "npm"
-    directories:
-      - "/"
-      - "/schemas"
-      - "/source/nodejs"
+    directory: "/source/nodejs"
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 1