Files
Nikolay MiroshnichenkoandClaude Opus 5 63551f40cf ci: ignore mcp >=2 by version range; the semver-major rule did not hold
Dependabot opened the same mcp <3 widening a third time (PR #17) with
update-types: semver-major in place. The docs do not say whether update-types
covers requirement widening; a versions range is the documented, direct form.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-14 09:05:52 +02:00

37 lines
1.1 KiB
YAML

version: 2
updates:
# Runtime dependencies. Grouped so a quiet week produces one PR, not five.
- package-ecosystem: pip
directory: "/"
schedule:
interval: weekly
day: monday
open-pull-requests-limit: 5
groups:
python-deps:
patterns: ["*"]
ignore:
# mcp 2.x removed mcp.server.fastmcp (FastMCP -> MCPServer). Verified against
# mcp 2.2.0: the import raises ModuleNotFoundError. 2.x stays out until the
# server is ported; 1.x updates still come through.
# An explicit version range, not update-types: the semver-major rule did not
# stop Dependabot from widening "<2" to "<3" (PRs #15, #16, #17). The docs do
# not say whether update-types applies to requirement widening; a range does.
- dependency-name: mcp
versions: [">=2"]
commit-message:
prefix: deps
# Action versions. These are pinned by tag and go stale silently.
- package-ecosystem: github-actions
directory: "/"
schedule:
interval: weekly
day: monday
open-pull-requests-limit: 3
groups:
actions:
patterns: ["*"]
commit-message:
prefix: ci