# Dependabot posture: alerts only, no pull requests.
# Vulnerability and version alerts still surface under the Security tab (plus
# the `cargo audit` / `cargo deny` gates on push), but Dependabot opens no
# PRs: every `updates:` block below carries `open-pull-requests-limit: 0`.
# (Automated *security-update* PRs are a separate toggle in repo Settings →
# Code security, not this file.) To re-enable version PRs, restore the
# limits (they were 5/5/3/1, weekly Monday 06:00 UTC, grouped minor+patch).
version: 2
updates:
  - package-ecosystem: "cargo"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "06:00"
      timezone: "UTC"
    open-pull-requests-limit: 0
    labels:
      - "dependencies"
    commit-message:
      prefix: "chore"
    groups:
      minor-patch:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "06:00"
      timezone: "UTC"
    open-pull-requests-limit: 0
    labels:
      - "dependencies"
    commit-message:
      prefix: "chore"
    groups:
      actions:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "06:00"
      timezone: "UTC"
    open-pull-requests-limit: 0
    labels:
      - "dependencies"
    commit-message:
      prefix: "chore"
    groups:
      base-images:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"
  - package-ecosystem: "docker"
    directory: "/.clusterfuzzlite"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "06:00"
      timezone: "UTC"
    open-pull-requests-limit: 0
    labels:
      - "dependencies"
    commit-message:
      prefix: "chore"
    groups:
      base-images:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"