[dimitri-yatsenko]

Summary

.github/dependabot.yml covers only the github-actions ecosystem, so Dependabot never proposes version updates for the Python dependencies in pyproject.toml. This adds a pip entry.

• versioning-strategy: increase-if-necessary: datajoint is a library, and its requirements are minimum versions (>=). A requirement that already admits a new release is left alone, so routine releases of numpy, pandas, etc. do not raise datajoint's minimums. In practice, version-update PRs appear only when an upper bound (<) excludes a new release.
• Version updates are one PR per package: each one raises an upper bound and gets its own test run and review.
• deepdiff majors are ignored: deepdiff<9; python_version >= '3.15' is deliberate (deepdiff 9 requires cachebox<6, which has no 3.15 wheels), so Dependabot does not propose widening it.
• Security update PRs are grouped into one PR per run (applies-to: security-updates). The alerts and security updates themselves come from the dependency graph and the repository's Dependabot security-updates setting, not from this file; this entry only groups the resulting PRs.
• Weekly schedule, Wednesday 09:00 Central.

Related

• fix: Dependabot config fails to parse (schedule time must be HH:MM) #1651 fixes the time value in the existing github-actions entry. Until it merges, Dependabot cannot parse this file at all. The two PRs touch different lines and merge in either order.
• Dependabot alerts come from the dependency graph, which omits every requirement without a version specifier. fix: declare minimum versions for all core dependencies #1653 adds minimum versions so these packages are covered.
• Dependabot does not support pixi, so pixi.lock is not scanned.

[MilagrosMarin]

Thanks @dimitri-yatsenko, this looks good, and increase-if-necessary is the right strategy for a library.

One thing to handle before merging:

• deepdiff cap: pyproject.toml deliberately keeps deepdiff<9; python_version >= '3.15' (cachebox has no 3.15 wheels). With increase-if-necessary, Dependabot widens upper bounds to admit new majors, so I'd expect a weekly PR bumping it to <10. Suggest ignoring that:

      ignore:
        - dependency-name: "deepdiff"
          update-types: ["version-update:semver-major"]

Minor:

• Version updates aren't grouped (only applies-to: security-updates is), so the remaining < caps, extras and the test dependency group will arrive as one PR per package. Fine if that's intended.
• Small wording note for the description: security alerts and fixes come from the dependency graph and the repo setting rather than this file, so the new entry mainly adds version updates and groups the security PRs.

Confirmed it merges cleanly with #1651 in either order. Let me know what you think!

[dimitri-yatsenko]

Thanks @MilagrosMarin.

• deepdiff cap: Fixed in 550bd8f: the pip entry now ignores version-update:semver-major for deepdiff, with a comment pointing at the 3.15 cap in pyproject.toml.
• Grouping: I'm keeping version updates one PR per package. With increase-if-necessary they only appear when an upper bound excludes a new release, and each such bump deserves its own CI run and review. 550bd8f says so in a comment.
• Description: Updated. It now says the alerts and security updates come from the dependency graph and the repository setting, and that this file adds version updates and groups the security PRs.

[MilagrosMarin]

Thanks @dimitri-yatsenko, all addressed in 550bd8f:

✅ deepdiff majors ignored, with the pointer to the 3.15 cap in pyproject.toml
✅ One PR per package for version updates makes sense with increase-if-necessary, and the comment explains it
✅ Description now separates the dependency graph and repo setting from what this file adds

The failing .github/dependabot.yml check should clear once #1651 merges (time: "9:00" on master). LGTM!

[dimitri-yatsenko]

The failing .github/dependabot.yml check came from time: "9:00" in the existing github-actions entry, which this branch inherits from master. I cherry-picked the fix from #1651 (9:00 → 09:00), so this PR passes on its own. Both PRs make the identical change and still merge cleanly in either order. The file also validates against the SchemaStore Dependabot schema.

@MilagrosMarin, could you take another look? The only change since your approval is this one line.

[MilagrosMarin]

Thanks @dimitri-yatsenko! Re-reviewed c9e65d9:

✅ Only change since my last review is time: "9:00" → "09:00" in the github-actions entry
✅ .github/dependabot.yml check now passes
✅ Identical to the #1651 fix, so the two merge cleanly in either order

LGTM!