version: 2
updates:
- package-ecosystem: cargo
directory: /
schedule:
interval: weekly
cooldown:
default-days: 7
open-pull-requests-limit: 10
groups:
cargo-dependencies:
patterns:
- "*"
ignore:
# `dbus-secret-service` (keyring default feature) pins sha2 0.10.x as a
# transitive dep, so bumping the direct dep to 0.11.x cannot collapse to
# a single version — it only adds a duplicate crypto stack
# (sha2/digest/crypto-common/block-buffer/cpufeatures all doubled).
# Revisit when the keyring chain moves to digest 0.11. See #207, #184.
- dependency-name: "sha2"
versions:
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
cooldown:
default-days: 7
open-pull-requests-limit: 10
groups:
github-actions-dependencies:
patterns:
- "*"