dependabot.yml

# Dependency updates with a cooldown, so a freshly published version is never pulled
# in the window when a compromised release is most likely to still be up.
version: 2
updates:
  - package-ecosystem: "uv"
    directory: "/"
    schedule:
      interval: "weekly"
    cooldown:
      default-days: 7
    open-pull-requests-limit: 5
    labels: ["dependencies"]

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    cooldown:
      default-days: 7
    open-pull-requests-limit: 5
    labels: ["dependencies", "ci"]

  # The page-check toolchain: html-validate, axe-core and jsdom. Development only.
  # Nothing from npm ships in the site; the pages carry no script at all.
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    cooldown:
      default-days: 7
    open-pull-requests-limit: 5
    labels: ["dependencies", "ci"]