version: 2

updates:

# Root package dependencies.

# NOTE: Dependabot's npm updater recurses from "/" into every nested

# package.json, and neither the singular `directory` nor plural `directories`

# with `!` exclusion globs stops that recursion. So the ONLY reliable way to

# keep this entry from bumping the components/renderer/@plotly packages (which

# each carry their own narrow allow/ignore lists, e.g. react-docgen is pinned)

# is the `allow` list below: it names only packages that exist SOLELY in the

# root package.json, so even while recursing, Dependabot opens root-only PRs.

# npm-run-all, rimraf and @types/jest are intentionally omitted: they also live

# in the components and would produce duplicate PRs.

- package-ecosystem: "npm"

directory: "/"

schedule:

interval: "weekly"

day: "monday"

cooldown:

default-days: 14

groups:

npm-dependencies:

applies-to: version-updates

patterns:

- "*"

npm-dependencies-security:

applies-to: security-updates

patterns:

- "*"

allow:

- dependency-name: "@lerna/*"

- dependency-name: "@percy/cli"

- dependency-name: "husky"

- dependency-name: "lerna"

- dependency-name: "lint-staged"

# Dash renderer

- package-ecosystem: "npm"

directory: "/dash/dash-renderer"

schedule:

interval: "weekly"

day: "monday"

cooldown:

default-days: 14

groups:

npm-dependencies:

applies-to: version-updates

patterns:

- "*"

npm-dependencies-security:

applies-to: security-updates

patterns:

- "*"

allow:

- dependency-name: "@types/*"

- dependency-name: "@babel/*"

- dependency-name: "babel-loader"

- dependency-name: "ts-loader"

- dependency-name: "cookie"

- dependency-name: "webpack*"

- dependency-name: "typescript"

ignore:

# typescript 6+ (and the native tsc 7) fail the renderer type-check. Stay on 5.x.

- dependency-name: "typescript"

versions: [">=6.0.0"]

# Babel 8 / babel-loader 10 break the build (the class-properties plugin

# peer-deps on @babel/core ^7). Stay on the 7.x / 9.x line.

- dependency-name: "@babel/*"

versions: [">=8.0.0"]

- dependency-name: "babel-loader"

versions: [">=10.0.0"]

# @types/ramda is exact-pinned to 0.29.x to match the types-ramda override

# in package.json (each @types/ramda minor targets a matching types-ramda).

- dependency-name: "@types/ramda"

versions: [">=0.30.0"]

# Components - dash-core-components

- package-ecosystem: "npm"

directory: "/components/dash-core-components"

schedule:

interval: "weekly"

day: "monday"

cooldown:

default-days: 14

groups:

npm-dependencies:

applies-to: version-updates

patterns:

- "*"

npm-dependencies-security:

applies-to: security-updates

patterns:

- "*"

# Only auto-update these packages for version updates

allow:

- dependency-name: "date-fns"

- dependency-name: "file-saver"

- dependency-name: "ramda"

- dependency-name: "react-window"

- dependency-name: "@radix-ui/*"

- dependency-name: "@types/*"

- dependency-name: "@babel/*"

- dependency-name: "babel-loader"

- dependency-name: "webpack*"

- dependency-name: "typescript"

# react-docgen is pinned for legacy metadata extraction (extract-meta.js uses

# the react-docgen 5 API) and must never be updated.

ignore:

- dependency-name: "react-docgen"

# react-window 2.x is a full API rewrite; the components use the 1.x API.

- dependency-name: "react-window"

versions: [">=2.0.0"]

# typescript 6+ (and the native tsc 7) break the type-check. Stay on 5.x.

- dependency-name: "typescript"

versions: [">=6.0.0"]

# Babel 8 / babel-loader 10 break the build (the class-properties plugin

# peer-deps on @babel/core ^7). Stay on the 7.x / 9.x line.

- dependency-name: "@babel/*"

versions: [">=8.0.0"]

- dependency-name: "babel-loader"

versions: [">=10.0.0"]

# Components - dash-html-components

- package-ecosystem: "npm"

directory: "/components/dash-html-components"

schedule:

interval: "weekly"

day: "monday"

cooldown:

default-days: 14

groups:

npm-dependencies:

applies-to: version-updates

patterns:

- "*"

npm-dependencies-security:

applies-to: security-updates

patterns:

- "*"

allow:

- dependency-name: "@types/*"

- dependency-name: "@babel/*"

- dependency-name: "babel-loader"

- dependency-name: "webpack*"

- dependency-name: "typescript"

# react-docgen is pinned for legacy metadata extraction (extract-meta.js uses

# the react-docgen 5 API) and must never be updated.

ignore:

- dependency-name: "react-docgen"

# Babel 8 / babel-loader 10 break the build (the class-properties plugin

# peer-deps on @babel/core ^7). Stay on the 7.x / 9.x line.

- dependency-name: "@babel/*"

versions: [">=8.0.0"]

- dependency-name: "babel-loader"

versions: [">=10.0.0"]

# Components - dash-table

- package-ecosystem: "npm"

directory: "/components/dash-table"

schedule:

interval: "weekly"

day: "monday"

cooldown:

default-days: 14

groups:

npm-dependencies:

applies-to: version-updates

patterns:

- "*"

npm-dependencies-security:

applies-to: security-updates

patterns:

- "*"

allow:

- dependency-name: "@types/*"

- dependency-name: "@babel/*"

- dependency-name: "babel-loader"

- dependency-name: "ts-loader"

- dependency-name: "css-loader"

- dependency-name: "less"

- dependency-name: "less-loader"

- dependency-name: "webpack*"

- dependency-name: "typescript"

# react-docgen is pinned for legacy metadata extraction (extract-meta.js uses

# the react-docgen 5 API) and must never be updated.

ignore:

- dependency-name: "react-docgen"

# typescript 6+ (and the native tsc 7) break the type-check. Stay on 5.x.

- dependency-name: "typescript"

versions: [">=6.0.0"]

# Babel 8 / babel-loader 10 break the build (the class-properties plugin

# peer-deps on @babel/core ^7). Stay on the 7.x / 9.x line.

- dependency-name: "@babel/*"

versions: [">=8.0.0"]

- dependency-name: "babel-loader"

versions: [">=10.0.0"]

# @plotly workspace packages (build helpers, jupyterlab, and the generator /

# test-component fixtures). These have no per-package config, so without this

# entry Dependabot's root "/" recursion opens an individual, ungrouped PR for

# each one. The `directories` glob claims every /@plotly/* manifest and folds

# them into a single grouped PR.

- package-ecosystem: "npm"

directories:

- "/@plotly/*"

schedule:

interval: "weekly"

day: "monday"

cooldown:

default-days: 14

groups:

npm-dependencies:

applies-to: version-updates

patterns:

- "*"

npm-dependencies-security:

applies-to: security-updates

patterns:

- "*"

ignore:

# react-docgen is pinned for legacy metadata extraction (extract-meta.js uses

# the react-docgen 5 API) and must never be updated.

- dependency-name: "react-docgen"

# The test/generator fixtures pin React 16 (react-jsx-parser peer-deps on

# 16/17); a major bump breaks them. Stay on 16.x.

- dependency-name: "react"

versions: [">=17.0.0"]

- dependency-name: "react-dom"

versions: [">=17.0.0"]

# typescript 6+ (and the native tsc 7) break the type-check. Stay on 5.x.

- dependency-name: "typescript"

versions: [">=6.0.0"]

# Babel 8 / babel-loader 10 break the build (the class-properties plugin

# peer-deps on @babel/core ^7). Stay on the 7.x / 9.x line.

- dependency-name: "@babel/*"

versions: [">=8.0.0"]

- dependency-name: "babel-loader"

versions: [">=10.0.0"]

# Python dependencies

- package-ecosystem: "pip"

directory: "/"

schedule:

interval: "weekly"

day: "monday"

cooldown:

default-days: 14

# Keep lower bounds (e.g. Flask>=1.0.4 in install.txt) low: only raise a

# floor when the latest release is incompatible with the current range.

# Exact (==) pins in ci/dev/testing still update as normal.

versioning-strategy: increase-if-necessary

groups:

pip-dependencies:

applies-to: version-updates

patterns:

- "*"

pip-dependencies-security:

applies-to: security-updates

patterns:

- "*"

# jupyterlab is pinned <4.0.0: jupyterlab 4.x ships jlpm as Yarn Berry, which

# cannot consume @plotly/dash-jupyterlab's Yarn 1 lockfile and breaks the build.

#

# black >=25.12.0 and pylint >=4.0.0 require Python >=3.10 and cannot install

# on the 3.9 CI jobs (Dash still supports Python 3.9). Upgrading either past

# its last 3.9-compatible release (black 25.11.0, pylint 3.3.9) also forces a

# repo-wide reformat / lint-fix pass, so linter bumps are done deliberately,

# not via Dependabot.

ignore:

- dependency-name: "jupyterlab"

versions: [">=4.0.0"]

- dependency-name: "black"

versions: [">=25.12.0"]

- dependency-name: "pylint"

versions: [">=4.0.0"]