feat: Use Dependabot to check for Node updates

[HonkingGoose]

Changes:

• Use Dependabot to check for node package updates

Context:

I noticed some packages are out of date, and could use updates.
Dependabot can help with managing your development dependencies.

What will happen when you merge this pull:

This commits enables Dependabot in this repository.
It will check for Node updates each working day (Monday trough Friday).
It will run the check at 8 o'clock Dutch time.

Dependabot will use the default labels: "dependencies".
You don't need to add any labels to the repository, Dependabot will manage those automatically.

When you merge this pull request, Dependabot will do a run right away.
Afterwards it will follow the schedule.

Documentation for Dependabot configuration:

For more information on how to configure Dependabot to your liking: https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates

[Kilian]

Just for my understanding: This repository already gets PRs from dependabot. Does adding this config mean that they get merged automatically?

[HonkingGoose]

Does adding this config mean that they get merged automatically?

No, automatic merging is not possible with the GitHub-native Dependabot.

From one of the main developers for Dependabot (dependabot/dependabot-core#1973 (comment)):

Auto-merge will not be supported in GitHub-native Dependabot for the foreseeable future. We know some of you have built great workflows that rely on auto-merge, but right now, we’re concerned about auto-merge being used to quickly propagate a malicious package across the ecosystem. We recommend always verifying your dependencies before merging them.

---

This repository already gets PRs from Dependabot.

You only get security updates right now, because GitHub will push those to users when necessary by default.

When you merge this pull request, you'll get normal updates as well.

For more on security updates read: https://docs.github.com/en/free-pro-team@latest/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates

[Kilian]

Oh, right! I'm not sure if normal updates are a good idea, but lets try :)