dependabot.yml

# Please see the documentation for all configuration options:
# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file

version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "monthly"
    commit-message:
      prefix: "Dockerfile"

  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "monthly"
    groups:
      minor-and-patch:
        update-types:
          - "minor"
          - "patch"
        exclude-patterns:
          - "pydantic*"

      # pydantic is a known violator of version updates where they don't release the core backend
      # with the API library at the same time which holds up other legitimate updates, so group
      # pydantic deps together
      pydantic:
        update-types:
          - "minor"
          - "patch"
        patterns:
          - "pydantic*"