[openstreetmap/openstreetmap-website] Update dependabot configuration to allow all gem upgrades (PR #7380)

[Andy Allan]

I was surprised looking at 7629f9a0780e11215711748f00dd8384d95842f7 because the linked issue was merged a month ago and there's already been several releases of sprockets since.

So the key question is why dependabot seems to be ignoring sprockets. This is because by default it only looks at "top-level" gems (specified in the Gemfile) and only the dependencies of top-levels gem that are being updated. So if the top-level gem hasn't been updated, none of its dependencies are considered. This is a problem for wrapper gems (like `dartsass-sprockets`) which don't get updated very often, even if the underlying dependency (e.g. `sprockets`) is where the action happens.

This PR changes the dependabot configuration to [consider all gem dependencies](https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#dependency-type-allow). There's no similar configuration for npm/yarn so there is nothing that needs changing here.

In this PR I also updated sprockets, to a version that supports json 3, but it turns out that we still need to wait on a rails/active_support release too. I've updated the Gemfile with this information.
You can view, comment on, or merge this pull request online at:

  https://github.com/openstreetmap/openstreetmap-website/pull/7380

-- Commit Summary --

  * Configure dependabot to update all dependencies
  * Update sprockets
  * Update pinning reason

-- File Changes --

    M .github/dependabot.yml (2)
    M Gemfile (3)
    M Gemfile.lock (4)

-- Patch Links --

https://github.com/openstreetmap/openstreetmap-website/pull/7380.patch
https://github.com/openstreetmap/openstreetmap-website/pull/7380.diff

-- 
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/openstreetmap-website/pull/7380
You are receiving this because you are subscribed to this thread.

Message ID: <openstreetmap/openstreetmap-website/pull/7380 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstreetmap.org/pipermail/rails-dev/attachments/20260910/18aabfdc/attachment.htm>