From 9f307df639706ad553efb53d1e86b33e0e0737f8 Mon Sep 17 00:00:00 2001 From: Karl Waldman Date: Mon, 13 Jul 2026 09:41:16 -0400 Subject: [PATCH] chore: add dependabot config (pip + github-actions, weekly) The repo had no dependabot.yml. Runtime deps are floor-pinned ranges so users already get current releases; this keeps the CI actions and dev toolchain from drifting silently. Co-Authored-By: Claude Fable 5 --- .github/dependabot.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..42f0dcc --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,26 @@ +# Dependabot configuration. +# +# Runtime deps in pyproject.toml are floor-pinned ranges (>=), so pip users +# already resolve to the latest compatible releases; the value here is +# keeping GitHub Actions pinned-by-tag workflows and the dev toolchain +# (pytest/mypy/ruff/etc.) from drifting silently. +version: 2 +updates: + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + open-pull-requests-limit: 5 + labels: + - "dependencies" + + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + open-pull-requests-limit: 5 + labels: + - "dependencies" + - "ci"