dependabot.yml

# SPDX-License-Identifier: AGPL-3.0-or-later
version: 2
updates:
  - package-ecosystem: "uv"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 5
    groups:
      python-dependencies:
        patterns: ["*"]
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 5
    # One PR for the whole CodeQL action set: init, analyze, autobuild and
    # upload-sarif must always run the same version. Since CodeQL Action
    # 3.30.4 the non-init steps hard-error when they load a configuration
    # file written by a different version, so a half-applied bump breaks the
    # scan rather than merely warning.
    groups:
      codeql-action:
        patterns:
          - "github/codeql-action*"
  - package-ecosystem: "docker"
    directory: "/relay"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 5