From 25b22cfbb086307c0a8bab40eb2b05bb77ebd101 Mon Sep 17 00:00:00 2001
From: Arunavo Ray <rayanup3@gmail.com>
Date: Thu, 29 Oct 2026 11:23:06 +0530
Subject: [PATCH] ci: add a Dependabot config with the bun ecosystem for the
 root

Without a dependabot.yml, security update jobs ran the npm ecosystem over
the root, which cannot update bun.lock, so every one of them failed.
The root now uses the bun ecosystem and the documentation site keeps npm
(it is locked with pnpm). open-pull-requests-limit is 0 for both, which
turns off version update pull requests and leaves security updates on,
as before.
---
 .github/dependabot.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..1d57ad6
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,20 @@
+# Dependabot reads this for security updates as well as version updates.
+# Without it, security updates for the root ran the npm ecosystem, which
+# cannot update bun.lock, and every security update job failed.
+#
+# open-pull-requests-limit: 0 turns off version update pull requests and
+# leaves security updates on, which is how the repository ran before.
+version: 2
+updates:
+  - package-ecosystem: "bun"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 0
+
+  # The documentation site, locked with pnpm.
+  - package-ecosystem: "npm"
+    directory: "/www"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 0