version: 2

updates:

# Maintain dependencies for GitHub Actions

- package-ecosystem: "github-actions"

directory: "/"

schedule:

interval: monthly

assignees:

- "ezio-melotti"

groups:

actions:

patterns:

- "*"

open-pull-requests-limit: 10

cooldown:

# https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns

# Cooldowns protect against supply chain attacks by avoiding the

# highest-risk window immediately after new releases.

default-days: 14

# Maintain dependencies for Python

- package-ecosystem: pip

directory: "/"

schedule:

interval: monthly

assignees:

- "ezio-melotti"

groups:

pip:

patterns:

- "*"

open-pull-requests-limit: 10

cooldown:

default-days: 14