.github/dependabot.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

version: 2
updates:
  - package-ecosystem: cargo
    directory: "/"
    schedule:
      interval: weekly
    target-branch: main
    labels: [auto-dependencies]
    open-pull-requests-limit: 15
    ignore:
      # major version bumps of arrow* and parquet are handled manually
      - dependency-name: "arrow*"
        update-types: ["version-update:semver-major"]
      - dependency-name: "parquet"
        update-types: ["version-update:semver-major"]
    groups:
      # minor and patch bumps of arrow* and parquet are grouped
      arrow-parquet:
        applies-to: version-updates
        patterns:
          - "arrow*"
          - "parquet"
        update-types:
          - "minor"
          - "patch"
      proto:
        applies-to: version-updates
        patterns:
          - "prost*"
          - "pbjson*"

        # Catch-all: group only minor/patch into a single PR,
        # excluding deps we want always separate (and excluding arrow/parquet which have their own group)
      all-other-cargo-deps:
        applies-to: version-updates
        patterns:
          - "*"
        exclude-patterns:
          - "arrow*"
          - "parquet"
          - "object_store"
          - "sqlparser"
          - "prost*"
          - "pbjson*"
        update-types:
          - "minor"
          - "patch"
  # the wasm test app has its own npm lockfile
  - package-ecosystem: npm
    directory: "/datafusion/wasmtest/datafusion-wasm-app"
    schedule:
      interval: weekly
    labels: [auto-dependencies]
    groups:
      # minor and patch bumps are grouped into a single PR
      all-npm-deps:
        applies-to: version-updates
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"
  - package-ecosystem: "github-actions"
    # "/" covers workflows in .github/workflows; the glob covers composite
    # actions such as .github/actions/setup-builder
    directories: ["/", "/.github/actions/*"]
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10
    labels: [auto-dependencies]
    groups:
      codeql-actions:
        patterns:
          - "github/codeql-action/*"
  # Python dependencies are managed as a uv workspace rooted at the top-level
  # pyproject.toml with a shared uv.lock
  - package-ecosystem: "uv"
    directory: "/"
    schedule:
      interval: "weekly"
    labels: [auto-dependencies]
    groups:
      # all dependency bumps are grouped into a single PR
      all-uv-deps:
        applies-to: version-updates
        patterns:
          - "*"
        update-types:
          - "major"
          - "minor"
          - "patch"