# To get started with Dependabot version updates, you'll need to specify which
# package ecosystems to update and where the package manifests are located.
# Please see the documentation for all configuration options:
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
version: 2
updates:
- package-ecosystem: "cargo" # See documentation for possible values
directory: "/" # Location of package manifests
schedule:
interval: "weekly"
# We would like dependabot to always bump the version in Cargo.toml
# instead of doing lockfile-only updates for in-range versions, because
# lockfile-only bumps are invisible to release-plz and go missing from
# release changelogs even when they matter for the shipped binaries
# (e.g. the vpin 0.26.10 panic fixes). dependabot-core supports
# "increase" for cargo since June 2026
# (https://github.com/dependabot/dependabot-core/pull/14306), but the
# hosted config validation still rejects anything except "auto" and
# "lockfile-only" for cargo
# (https://github.com/dependabot/dependabot-core/issues/12392), so we
# cannot set it yet; retry once that issue is resolved. Until then, or
# until release-plz can consider lockfile
# changes (https://github.com/release-plz/release-plz/issues/2852),
# add important lockfile-only bumps to the changelog manually.
- package-ecosystem: "github-actions"
directory: "/"
schedule:
# Check for updates to GitHub Actions every week
interval: "weekly"