version: 2
updates:
  # Rust workspace (root Cargo.toml + all member crates).
  - package-ecosystem: cargo
    directory: "/"
    schedule:
      interval: weekly
    open-pull-requests-limit: 10
    cooldown:
      default-days: 7
    commit-message:
      prefix: "deps(cargo)"

  # Node binding npm dependencies.
  - package-ecosystem: npm
    directory: "/bindings/node"
    schedule:
      interval: weekly
    open-pull-requests-limit: 10
    cooldown:
      default-days: 7
    commit-message:
      prefix: "deps(npm)"

  # Python binding pip dependencies.
  - package-ecosystem: pip
    directory: "/bindings/python"
    schedule:
      interval: weekly
    open-pull-requests-limit: 10
    cooldown:
      default-days: 7
    commit-message:
      prefix: "deps(pip)"

  # Hash-pinned CI/bench Python tooling under .github/requirements/. Each
  # <name>.in is the loose source; the matching hash-locked <name>.txt is the
  # output regenerated by scripts/update-lockfiles.sh (uv). Dependabot keeps the
  # pins fresh; ci-dev-py39.in caps numpy <2.1 so 3.9 stays installable. Any
  # bump that breaks a matrix row surfaces in the PR's CI run.
  - package-ecosystem: pip
    directory: "/.github/requirements"
    schedule:
      interval: weekly
    open-pull-requests-limit: 10
    cooldown:
      default-days: 7
    commit-message:
      prefix: "deps(ci-pip)"

  # GitHub Actions — keeps the SHA-pinned actions current (Dependabot reads
  # the version comment after each pinned SHA and bumps both together).
  - package-ecosystem: github-actions
    directory: "/"
    schedule:
      interval: weekly
    open-pull-requests-limit: 10
    cooldown:
      default-days: 7
    commit-message:
      prefix: "deps(actions)"