Skip to content

Add Dependabot configuration for automated dependency updates (#2378)#2387

Open
mr-raj12 wants to merge 1 commit intoborgbase:masterfrom
mr-raj12:fix/dependabot-config-2378
Open

Add Dependabot configuration for automated dependency updates (#2378)#2387
mr-raj12 wants to merge 1 commit intoborgbase:masterfrom
mr-raj12:fix/dependabot-config-2378

Conversation

@mr-raj12
Copy link
Contributor

@mr-raj12 mr-raj12 commented Feb 5, 2026

Description

Add .github/dependabot.yml to enable automated dependency update PRs for two ecosystems:

  • github-actions — weekly checks for newer versions of Actions (checkout, cache, upload-artifact, setup-uv, codecov-action, action-tmate)
  • uv — weekly checks for Python dependency updates (updates both pyproject.toml and uv.lock)

Pre-commit hooks are excluded since pre-commit.ci already handles those updates.

Related Issue

Closes #2378

Motivation and Context

The repository has no automated dependency update mechanism. Maintainers have to manually check for new versions of GitHub Actions and Python packages, which
means security patches and updates can be missed.

How Has This Been Tested?

  • YAML syntax validated locally
  • This is a GitHub server-side configuration — Dependabot will activate after merge to the default branch

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

  • I have read the CONTRIBUTING guide.
  • My code follows the code style of this project.
  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I have added tests to cover my changes.
  • All new and existing tests passed.

I provide my contribution under the terms of the license of this repository and I affirm the Developer Certificate of Origin.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add Dependabot configuration for automated dependency updates

1 participant