# Keep the three runtime deps and the CI actions patched. Dependabot opens
# PRs; CI runs the offline test suite against them before anything merges.
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
    open-pull-requests-limit: 5
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
    groups:
      # init and analyze must run the same version, so bump them in one PR.
      codeql-action:
        patterns:
          - github/codeql-action*