wickra/.github/dependabot.yml

version: 2
updates:
  # Rust workspace (root Cargo.toml + all member crates).
  - package-ecosystem: cargo
    directory: "/"
    schedule:
      interval: weekly
    open-pull-requests-limit: 10
    cooldown:
      default-days: 7
    commit-message:
      prefix: "deps(cargo)"
    # ureq is intentionally pinned to 2.x. ureq 3 unconditionally pulls
    # webpki-root-certs (CDLA-Permissive-2.0); the native-tls / OS-trust-store
    # setup in wickra-data deliberately avoids that licence. Block the major
    # bump (2.x patch/minor still flow through).
    ignore:
      - dependency-name: "ureq"
        update-types: ["version-update:semver-major"]
    groups:
      # napi-rs (napi / napi-derive / napi-build) is a coordinated major
      # migration that must move with @napi-rs/cli on the npm side — keep it in
      # its own PR rather than bundled with unrelated crate bumps.
      napi:
        patterns: ["napi", "napi-derive", "napi-build"]
      cargo:
        patterns: ["*"]
        exclude-patterns: ["napi", "napi-derive", "napi-build"]

  # Node binding npm dependencies.
  - package-ecosystem: npm
    directory: "/bindings/node"
    schedule:
      interval: weekly
    open-pull-requests-limit: 10
    cooldown:
      default-days: 7
    commit-message:
      prefix: "deps(npm)"
    groups:
      node-binding:
        patterns: ["*"]

  # Python binding pip dependencies.
  - package-ecosystem: pip
    directory: "/bindings/python"
    schedule:
      interval: weekly
    open-pull-requests-limit: 10
    cooldown:
      default-days: 7
    commit-message:
      prefix: "deps(pip)"
    groups:
      python-binding:
        patterns: ["*"]

  # Hash-pinned CI/bench Python tooling under .github/requirements/. Each
  # <name>.in is the loose source; the matching hash-locked <name>.txt is the
  # output regenerated by scripts/update-lockfiles.sh (uv). Dependabot keeps the
  # pins fresh; ci-dev-py39.in caps numpy <2.1 so 3.9 stays installable. Any
  # bump that breaks a matrix row surfaces in the PR's CI run.
  - package-ecosystem: pip
    directory: "/.github/requirements"
    schedule:
      interval: weekly
    open-pull-requests-limit: 10
    cooldown:
      default-days: 7
    commit-message:
      prefix: "deps(ci-pip)"
    groups:
      ci-pip:
        patterns: ["*"]

  # GitHub Actions — keeps the SHA-pinned actions current (Dependabot reads
  # the version comment after each pinned SHA and bumps both together).
  - package-ecosystem: github-actions
    directory: "/"
    schedule:
      interval: weekly
    open-pull-requests-limit: 10
    cooldown:
      default-days: 7
    commit-message:
      prefix: "deps(actions)"
    groups:
      github-actions:
        patterns: ["*"]

  # Java binding + examples (Maven). Tracks the C-ABI binding's build plugins
  # (e.g. central-publishing-maven-plugin) and the examples' jackson dependency,
  # which had no Dependabot coverage before — a stale publishing plugin slipped
  # through unnoticed until an OSV scan flagged it.
  - package-ecosystem: maven
    directories:
      - "/bindings/java"
      - "/bindings/java/benchmarks"
      - "/examples/java"
    schedule:
      interval: weekly
    open-pull-requests-limit: 10
    cooldown:
      default-days: 7
    commit-message:
      prefix: "deps(maven)"
    groups:
      maven:
        patterns: ["*"]

  # C# binding (NuGet). The published Wickra.csproj is a thin C-ABI wrapper with
  # no external packages, but the test and benchmark projects pull xunit,
  # Microsoft.NET.Test.Sdk and BenchmarkDotNet.
  - package-ecosystem: nuget
    directories:
      - "/bindings/csharp/Wickra.Tests"
      - "/bindings/csharp/benchmarks"
    schedule:
      interval: weekly
    open-pull-requests-limit: 10
    cooldown:
      default-days: 7
    commit-message:
      prefix: "deps(nuget)"
    groups:
      nuget:
        patterns: ["*"]

  # Node examples (npm) — separate from the binding's own package.json.
  - package-ecosystem: npm
    directory: "/examples/node"
    schedule:
      interval: weekly
    open-pull-requests-limit: 10
    cooldown:
      default-days: 7
    commit-message:
      prefix: "deps(npm)"
    groups:
      node-examples:
        patterns: ["*"]

  # Go examples (Go modules). The binding's own go.mod has no external deps;
  # the examples pull coder/websocket.
  - package-ecosystem: gomod
    directory: "/examples/go"
    schedule:
      interval: weekly
    open-pull-requests-limit: 10
    cooldown:
      default-days: 7
    commit-message:
      prefix: "deps(gomod)"
    groups:
      go-examples:
        patterns: ["*"]