dependabot.yaml

# dependabot.yml reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
#
# Notes:
# - Status and logs from dependabot are provided at
#   https://github.com/jupyterhub/zero-to-jupyterhub-k8s/network/updates.
# - YAML anchors are not supported here or in GitHub Workflows.
#
version: 2
updates:
  # Maintain dependencies in our GitHub Workflows
  - package-ecosystem: github-actions
    directory: /
    labels: [ci]
    schedule:
      interval: monthly
      time: "05:00"
      timezone: Etc/UTC
  - package-ecosystem: pip
    directory: /images/hub/unfrozen
    labels: [breaking]
    groups:
      major-versions:
        update-types: [major]
        exclude-patterns:
          - jupyterhub # bumped by other automation
    schedule:
      interval: daily
      time: "05:00"
      timezone: Etc/UTC