1  version: 2
 2  updates:
 3    # Python dependencies declared in pyproject.toml.
 4    # open-pull-requests-limit: 0 disables routine version-bump PRs while
 5    # still allowing Dependabot to raise security advisories when a CVE
 6    # affects one of our dependencies. Raise this number if we start to
 7    # need regular version updates too.
 8    - package-ecosystem: "pip"
 9      directory: "/"
10      schedule:
11        interval: "weekly"
12      open-pull-requests-limit: 0
13      labels:
14        - "area: mcp"
15        - "needs-triage"
16  
17    # GitHub Actions used in .github/workflows. Keeping these up to date
18    # is low-risk and protects the CI supply chain, so we allow a small
19    # number of routine version-bump PRs in addition to security updates.
20    - package-ecosystem: "github-actions"
21      directory: "/"
22      schedule:
23        interval: "weekly"
24      open-pull-requests-limit: 5
25      labels:
26        - "needs-triage"