# SPDX-License-Identifier: PMPL-1.0-or-later

# Dependabot configuration for RSR-compliant repositories

# Covers common ecosystems - remove unused ones for your project

version: 2

updates:

# GitHub Actions - always include

- package-ecosystem: "github-actions"

directory: "/"

schedule:

interval: "weekly"

groups:

actions:

patterns:

- "*"

# Rust/Cargo

- package-ecosystem: "cargo"

directory: "/"

schedule:

interval: "weekly"

# `open-pull-requests-limit: 0` suppresses routine version-update PRs

# while leaving Dependabot SECURITY PRs flowing. The previous

# `ignore: "*" patch` rule also silenced security PRs under GitHub\'s

# current Dependabot behaviour. See rsr-template-repo commit 78b050e

# and 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.

open-pull-requests-limit: 0

# Elixir/Mix

- package-ecosystem: "mix"

directory: "/"

schedule:

interval: "weekly"

# Node.js/npm

- package-ecosystem: "npm"

directory: "/"

schedule:

interval: "weekly"

# Python/pip

- package-ecosystem: "pip"

directory: "/"

schedule:

interval: "weekly"

# Nix flakes

- package-ecosystem: "nix"

directory: "/"

schedule:

interval: "weekly"