# Dependabot configuration # Docs: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file # # Grouping policy: collapse all minor+patch bumps into ONE PR per ecosystem so # the review queue stays small; majors get their own grouped PR per ecosystem so # breaking changes still get individual scrutiny. version: 2 updates: # ─── JavaScript / pnpm workspace ────────────────────────────────────────── - package-ecosystem: "npm" directory: "/" schedule: interval: "weekly" day: "monday" time: "06:00" timezone: "Europe/London" open-pull-requests-limit: 5 commit-message: prefix: "chore(deps)" include: "scope" labels: - "dependencies" - "javascript" groups: npm-minor-patch: patterns: - "*" update-types: - "minor" - "patch" npm-major: patterns: - "*" update-types: - "major" # ─── Rust / Cargo (Tauri desktop shell) ─────────────────────────────────── - package-ecosystem: "cargo" directory: "/packages/desktop/src-tauri" schedule: interval: "weekly" day: "monday" time: "06:00" timezone: "Europe/London" open-pull-requests-limit: 3 commit-message: prefix: "chore(deps)" include: "scope" labels: - "dependencies" - "rust" groups: cargo-minor-patch: patterns: - "*" update-types: - "minor" - "patch" cargo-major: patterns: - "*" update-types: - "major" # ─── GitHub Actions workflow pins ───────────────────────────────────────── - package-ecosystem: "github-actions" directory: "/" schedule: interval: "weekly" day: "monday" time: "06:00" timezone: "Europe/London" open-pull-requests-limit: 3 commit-message: prefix: "chore(ci)" include: "scope" labels: - "dependencies" - "github-actions" groups: github-actions: patterns: - "*"