ci: Dependabot watches Python dependencies, not only GitHub Actions

.github/dependabot.yml

@@ -5,8 +5,30 @@ updates:
     schedule:
       interval: "monthly"
       day: "wednesday"
-      time: "9:00"
+      time: "09:00"
       timezone: "America/Chicago"
     groups:
       all-actions:
-        patterns: [ "*" ]
+        patterns: [ "*" ]
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "09:00"
+      timezone: "America/Chicago"
+    # datajoint is a library: its dependencies declare minimum versions only.
+    # Leave a requirement alone when it already admits the new release, so
+    # users are not pushed onto the newest version of each dependency.
+    versioning-strategy: "increase-if-necessary"
+    # deepdiff<9 on Python 3.15 is deliberate (see pyproject.toml); do not
+    # propose raising it to admit a new major version.
+    ignore:
+      - dependency-name: "deepdiff"
+        update-types: [ "version-update:semver-major" ]
+    # Version updates stay one PR per package: each one raises an upper bound
+    # and gets its own test run and review. Security updates are grouped.
+    groups:
+      python-security:
+        applies-to: security-updates
+        patterns: [ "*" ]