dependabot.yml

version: 2
# Upgradability and vulnerability management. `make verify` already runs
# `pip-audit`, which catches a dependency that is *already* known-vulnerable.
# This config covers the other half: keeping the pinned Python set, the Node
# gate toolchain, and the SHA-pinned action set current, at a weekly PR volume
# one maintainer can actually review.
updates:
  - package-ecosystem: uv
    directory: "/"
    schedule:
      interval: weekly
    open-pull-requests-limit: 5
    labels: ["dependencies"]
    commit-message:
      prefix: "build"

  # html-validate and axe-core are build-time page gates, never shipped to a
  # reader; they still need to stay current to keep catching what they catch.
  - package-ecosystem: npm
    directory: "/"
    schedule:
      interval: weekly
    open-pull-requests-limit: 5
    labels: ["dependencies"]
    commit-message:
      prefix: "build"

  - package-ecosystem: github-actions
    directory: "/"
    schedule:
      interval: weekly
    open-pull-requests-limit: 5
    labels: ["dependencies", "ci"]
    commit-message:
      prefix: "ci"
    # One PR for the whole CodeQL action set: init, analyze, autobuild and
    # upload-sarif must always run the same version. Since CodeQL Action
    # 3.30.4 the non-init steps hard-error when they load a configuration
    # file written by a different version, so a half-applied bump breaks the
    # scan rather than merely warning.
    groups:
      codeql-action:
        patterns:
          - github/codeql-action*