dependabot.yml

# SEC-14 (update automation) and SEC-26 (SHAs kept current, 72h cooldown).
# Two ecosystems, because this repository pins in two places: `uv` for the Python
# lock (uv.lock, which pip-audit and `make verify` both read) and `github-actions`
# for the SHA-pinned actions in ci.yml, security.yml, and release.yml. A pinned SHA
# is only safe while something bumps it.
#
# A third ecosystem, `npm`, covers the dev-only accessibility harness in
# tools/a11y. Nothing there ships with the Python package, but axe-core is a
# gate this repository trusts, and a gate running a stale ruleset is a gate
# quietly reporting yesterday's answer.
#
# `cooldown` holds each update for seven days after the upstream release, which is
# longer than the 72 hours SEC-26 asks for and is what keeps Semgrep's
# `dependabot-missing-cooldown` rule quiet. Python updates are grouped so the lock
# moves in one reviewable pull request rather than one per package.
version: 2
updates:
  - package-ecosystem: uv
    directory: /
    schedule:
      interval: weekly
    open-pull-requests-limit: 5
    cooldown:
      default-days: 7
    groups:
      python-dependencies:
        patterns: ["*"]
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
    open-pull-requests-limit: 5
    cooldown:
      default-days: 7
  - package-ecosystem: npm
    directory: /tools/a11y
    schedule:
      interval: weekly
    open-pull-requests-limit: 5
    cooldown:
      default-days: 7
    groups:
      a11y-harness:
        patterns: ["*"]