From 4cc2dda6cf4da61509559e1b108de1b67d67ff59 Mon Sep 17 00:00:00 2001
From: Dimitri Yatsenko <dimitri.yatsenko@gmail.com>
Date: Thu, 5 Nov 2026 07:24:22 -0600
Subject: [PATCH 1/3] ci: add Dependabot coverage for Python dependencies

Adds a pip entry for pyproject.toml alongside the github-actions one.
increase-if-necessary keeps minimum-version requirements unchanged when
they already admit a new release; security updates are grouped.
---
 .github/dependabot.yml | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index aac560ed2..0a2243e1c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,4 +9,19 @@ updates:
       timezone: "America/Chicago"
     groups:
       all-actions:
-        patterns: [ "*" ]
\ No newline at end of file
+        patterns: [ "*" ]
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "09:00"
+      timezone: "America/Chicago"
+    # datajoint is a library: its dependencies declare minimum versions only.
+    # Leave a requirement alone when it already admits the new release, so
+    # users are not pushed onto the newest version of each dependency.
+    versioning-strategy: "increase-if-necessary"
+    groups:
+      python-security:
+        applies-to: security-updates
+        patterns: [ "*" ]

From 550bd8ff25d431cc072105b5cd8dbfe70544834a Mon Sep 17 00:00:00 2001
From: Dimitri Yatsenko <dimitri.yatsenko@gmail.com>
Date: Fri, 6 Nov 2026 08:40:27 -0600
Subject: [PATCH 2/3] ci: Dependabot leaves the deepdiff<9 cap on Python 3.15
 alone

pyproject.toml keeps deepdiff<9 for Python 3.15 on purpose: deepdiff 9
requires cachebox<6, which has no 3.15 wheels. With increase-if-necessary,
Dependabot would propose widening that cap at every new deepdiff major, so
ignore semver-major updates for deepdiff.

Also state that version updates stay one PR per package, since each raises
an upper bound and deserves its own test run and review.
---
 .github/dependabot.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 0a2243e1c..267fa1d43 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -21,6 +21,13 @@ updates:
     # Leave a requirement alone when it already admits the new release, so
     # users are not pushed onto the newest version of each dependency.
     versioning-strategy: "increase-if-necessary"
+    # deepdiff<9 on Python 3.15 is deliberate (see pyproject.toml); do not
+    # propose raising it to admit a new major version.
+    ignore:
+      - dependency-name: "deepdiff"
+        update-types: [ "version-update:semver-major" ]
+    # Version updates stay one PR per package: each one raises an upper bound
+    # and gets its own test run and review. Security updates are grouped.
     groups:
       python-security:
         applies-to: security-updates

From c9e65d9041536c3a00f3163a4135d9136fbefc36 Mon Sep 17 00:00:00 2001
From: Dimitri Yatsenko <dimitri.yatsenko@gmail.com>
Date: Wed, 4 Nov 2026 15:46:33 -0600
Subject: [PATCH 3/3] fix: use two-digit hour in dependabot schedule time

Dependabot rejects time "9:00" (must match ^\d\d:\d\d$), so the
config failed to parse and no GitHub Actions updates were scheduled.

(cherry picked from commit 247125c9105d25c786fe52dc115d48bdb669f9bf)
---
 .github/dependabot.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 267fa1d43..0b0fbc610 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,7 +5,7 @@ updates:
     schedule:
       interval: "monthly"
       day: "wednesday"
-      time: "9:00"
+      time: "09:00"
       timezone: "America/Chicago"
     groups:
       all-actions: