From 34769f31bcf5449e70e516740d29a13eb3918096 Mon Sep 17 00:00:00 2001
From: John Kennedy <65985482+jkennedyvz@users.noreply.github.com>
Date: Sat, 14 Feb 2026 11:36:12 -0800
Subject: [PATCH] chore: update dependabot.yml to comply with posture checks
 (#6780)

- Add schedule.day: monday to all entries
- Add groups configuration to prevent noisy per-dependency PRs
- Split pip directories into individual entries per Dependabot v2 spec
- Add npm ecosystem entries for js-examples and js-monorepo-example
subdirectories
- Specify package-manager: uv for all Python entries (repo uses uv.lock)

Thank you for contributing to LangGraph! Follow these steps to mark your
pull request as ready for review. **If any of these steps are not
completed, your PR will not be considered for review.**

- [x] **PR title**: Follows the format: {TYPE}({SCOPE}): {DESCRIPTION}
  - Examples:
    - feat(core): add multi-tenant support
    - fix(cli): resolve flag parsing error
    - docs(openai): update API usage examples
  - Allowed `{TYPE}` values:
- feat, fix, docs, style, refactor, perf, test, build, ci, chore,
revert, release
  - Allowed `{SCOPE}` values (optional):
- langgraph, docs, cli, checkpoint, checkpoint-postgres,
checkpoint-sqlite, prebuilt, scheduler-kafka, sdk-py
- Once you've written the title, please delete this checklist item; do
not include it in the PR.

- [x] **PR message**: ***Delete this entire checklist*** and replace
with
- **Description:** a description of the change. Include a [closing
keyword](https://docs.github.com/en/issues/tracking-your-work-with-issues/using-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword)
if applicable.
  - **Issue:** the issue # it fixes, if applicable
  - **Dependencies:** any dependencies required for this change
- **Twitter handle:** if your PR gets announced, and you'd like a
mention, we'll gladly shout you out!

- [x] **Add tests and docs**: If you're adding a new integration, you
must include:
1. A test for the integration, preferably unit tests that do not rely on
network access,
2. An example notebook showing its use. It lives in
`docs/docs/integrations` directory.

- [x] **Lint and test**: Run `make format`, `make lint` and `make test`
from the root of the package(s) you've modified. We will not consider a
PR unless these three are passing in CI. See [contribution
guidelines](https://docs.langchain.com/oss/python/contributing/overview)
for more.

Additional guidelines:

- Make sure optional dependencies are imported within a function.
- Please do not add dependencies to `pyproject.toml` files (even
optional ones) unless they are **required** for unit tests.
- Most PRs should not touch more than one package.
- Changes should be backwards compatible.
---
 .github/dependabot.yml | 106 +++++++++++++++++++++++++++++++++++++----
 1 file changed, 98 insertions(+), 8 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 84770db13..5467fb922 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,15 +4,105 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+      day: "monday"
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
 
   - package-ecosystem: "pip"
-    directories:
-      - "libs/checkpoint"
-      - "libs/checkpoint-postgres"
-      - "libs/checkpoint-sqlite"
-      - "libs/cli"
-      - "libs/langgraph"
-      - "libs/prebuilt"
-      - "libs/sdk-py"
+    directory: "/libs/checkpoint"
     schedule:
       interval: "weekly"
+      day: "monday"
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
+    package-manager: "uv"
+
+  - package-ecosystem: "pip"
+    directory: "/libs/checkpoint-postgres"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
+    package-manager: "uv"
+
+  - package-ecosystem: "pip"
+    directory: "/libs/checkpoint-sqlite"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
+    package-manager: "uv"
+
+  - package-ecosystem: "pip"
+    directory: "/libs/cli"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
+    package-manager: "uv"
+
+  - package-ecosystem: "pip"
+    directory: "/libs/langgraph"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
+    package-manager: "uv"
+
+  - package-ecosystem: "pip"
+    directory: "/libs/prebuilt"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
+    package-manager: "uv"
+
+  - package-ecosystem: "pip"
+    directory: "/libs/sdk-py"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
+    package-manager: "uv"
+
+  - package-ecosystem: "npm"
+    directory: "/libs/cli/js-examples"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "npm"
+    directory: "/libs/cli/js-monorepo-example"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"