krz/orgo

 1# Dependabot version updates.
 2#
 3# Two ecosystems, both weekly: the crates this is built from, and the actions the
 4# workflows pin by SHA. The action pins are the reason this matters more than usual —
 5# a pinned SHA never moves on its own, which is the point, and also means nothing tells
 6# you it has gone stale unless something does.
 7version: 2
 8updates:
 9  - package-ecosystem: "cargo"
10    directory: "/"
11    schedule:
12      interval: "weekly"
13    # A dependency bump can change rendered output — syntect owns the highlighting, and
14    # its syntax definitions are data. Grouping keeps that reviewable as one diff rather
15    # than five PRs landing in an order nobody chose.
16    groups:
17      rust-dependencies:
18        patterns: ["*"]
19
20  - package-ecosystem: "github-actions"
21    directory: "/"
22    schedule:
23      interval: "weekly"
24    groups:
25      actions:
26        patterns: ["*"]