1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
version: 2
updates:
# Every version bump is proposed, majors included. Patches are merged
# immediately and unconditionally — being on the latest patch is worth more
# than a green run, and a regression is caught by the next release rather
# than by holding the bump back (see dependabot-auto-merge.yml). Minors and
# majors wait for CI to go green. Groups only keep the PR count sane; they
# never filter out a version type.
#
# Every patch group is named `patches` on purpose: Dependabot puts the group
# name in the branch (`dependabot/<ecosystem>/patches-<hash>`), and
# dependabot-auto-merge.yml keys the immediate merge off that. Keep the name
# identical across ecosystems or the detection silently stops matching.
- package-ecosystem: cargo
directory: /
schedule:
interval: weekly
open-pull-requests-limit: 20
versioning-strategy: increase
labels:
- dependencies
- rust
groups:
patches:
patterns:
- "*"
update-types:
- patch
rust-minors:
patterns:
- "*"
update-types:
- minor
rust-majors:
patterns:
- "*"
update-types:
- major
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
open-pull-requests-limit: 20
# No `versioning-strategy` here, unlike cargo/npm below: the option is
# supported by bundler, cargo, composer, helm, mix, npm, pip, pub and uv
# only, and action pins are tags rather than ranges, so there is nothing
# for a strategy to widen.
labels:
- dependencies
- github-actions
groups:
# Named `patches` for the same reason as the other two ecosystems: this
# group had no patch split at all, so action bumps were the only
# dependency updates that could never produce a `patches-<hash>` branch
# and therefore the only ones that silently fell through to the gated
# path. `patches` is listed first so patches are claimed by it and
# minors/majors fall through to the catch-all below.
patches:
patterns:
- "*"
update-types:
- patch
github-actions:
patterns:
- "*"
# The root package.json is scripts-only (typescript, @types/node for the
# .ts tooling scripts). Same conventions as /site below: every version
# bump proposed, majors included, grouped to keep the PR count sane.
- package-ecosystem: npm
directory: /
schedule:
interval: weekly
open-pull-requests-limit: 20
versioning-strategy: increase
labels:
- dependencies
- npm
groups:
typescript-updates:
patterns:
- typescript
npm-majors:
patterns:
- "*"
update-types:
- major
npm-minors:
patterns:
- "*"
update-types:
- minor
patches:
patterns:
- "*"
update-types:
- patch
- package-ecosystem: npm
directory: /site
schedule:
interval: weekly
open-pull-requests-limit: 20
versioning-strategy: increase
labels:
- dependencies
- npm
groups:
astro-stack:
patterns:
- astro
- "@astrojs/*"
typescript-updates:
patterns:
- typescript
npm-majors:
patterns:
- "*"
update-types:
- major
npm-minors:
patterns:
- "*"
update-types:
- minor
patches:
patterns:
- "*"
update-types:
- patch