donfear/inup — dependency upgrade PR

Run inup on a schedule and open one rolling PR with safe dependency upgrades and a vulnerability-fix digest.

Trust Signals

name	description	required	default
target	How far to bump: minor (in-range only, default), patch (same major.minor only), or latest (includes majors).	no	minor
directory	Directory to run inup in.	no	.
package-manager	Force a package manager (npm, yarn, pnpm, bun). Empty = auto-detect from the lockfile.	no	""
node-version	Node.js version to set up for the run.	no	22
inup-version	inup version to run via npx (e.g. "1" or "latest"). Pin for reproducible runs.	no	latest
pr-branch	Branch for the rolling PR. Re-runs update this same branch/PR.	no	inup/dependency-upgrades
pr-title	Title of the rolling PR.	no	chore(deps): dependency upgrades
commit-message	Commit message for the upgrade commit.	no	chore(deps): upgrade dependencies via inup
base	Base branch the PR targets. Empty = the default branch.	no	""
labels	Comma- or newline-separated labels to apply to the PR.	no	dependencies
token	Token used to push the branch and open the PR. Pass a PAT to let the PR trigger other workflows (CI).	no	${{ github.token }}
committer	Commit committer, as "Display Name <email@address.com>". Defaults to the GitHub Actions bot.	no	github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
author	Commit author, as "Display Name <email@address.com>". Defaults to the user who triggered the run.	no	${{ github.actor }} <${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com>

name	description
outdated	Number of outdated packages found.
vulnerable	Number of outdated packages with known vulnerabilities.
pull-request-number	The number of the created/updated PR (empty if no changes).