element-synapse/.github/dependabot.yml

version: 2
# As dependabot is currently only run on a weekly basis, we raise the
# open-pull-requests-limit to 10 (from the default of 5) to better ensure we
# don't continuously grow a backlog of updates.
updates:
  - # "pip" is the correct setting for poetry, per https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem
    package-ecosystem: "pip"
    directory: "/"
    open-pull-requests-limit: 10
    schedule:
      interval: "weekly"
    # Group patch updates to packages together into a single PR, as they rarely
    # if ever contain breaking changes that need to be reviewed separately.
    # 
    # Less PRs means a streamlined review process.
    #
    # Python packages follow semantic versioning, and tend to only introduce
    # breaking changes in major version bumps. Thus, we'll group minor and patch
    # versions together.
    groups:
      minor-and-patches:
        applies-to: version-updates
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"
    # Prevent pulling packages that were recently updated to help mitigate
    # supply chain attacks. 14 days was taken from the recommendation at
    # https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns
    # where the author noted that 9/10 attacks would have been mitigated by a
    # two week cooldown.
    #
    # The cooldown only applies to general updates; security updates will still
    # be pulled in as soon as possible.
    cooldown:
      default-days: 14

  - package-ecosystem: "docker"
    directory: "/docker"
    open-pull-requests-limit: 10
    schedule:
      interval: "weekly"
    # For container versions, breaking changes are also typically only introduced in major
    # package bumps.
    groups:
      minor-and-patches:
        applies-to: version-updates
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"
    cooldown:
      default-days: 14

  - package-ecosystem: "github-actions"
    directory: "/"
    open-pull-requests-limit: 10
    schedule:
      interval: "weekly"
    # Similarly for GitHub Actions, breaking changes are typically only introduced in major
    # package bumps.
    groups:
      minor-and-patches:
        applies-to: version-updates
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"
    cooldown:
      default-days: 14

  - package-ecosystem: "cargo"
    directory: "/"
    open-pull-requests-limit: 10
    versioning-strategy: "lockfile-only"
    schedule:
      interval: "weekly"
    # The Rust ecosystem is special in that breaking changes are often introduced
    # in minor version bumps, as packages typically stay pre-1.0 for a long time.
    # Thus we specifically keep minor version bumps separate in their own PRs.
    groups:
      patches:
        applies-to: version-updates
        patterns:
          - "*"
        update-types:
          - "patch"
    cooldown:
      default-days: 14