pyRPCpyRPC ships through two package managers, which means dependency staleness compounds in two places: uv.lock for the Python workspace and package-lock.json for the npm packages. Until this week neither was monitored; updates happened when someone noticed a release note elsewhere. Dependabot now covers all four surfaces, and the configuration choices are the interesting part.
Four surfaces, one policy
pip / uv.lock (workspace + dev group) npm / packages/* via workspaces npm /docs the docs site, isolated on purpose github-actions / workflow action pins
The docs directory gets its own entry rather than riding along with root, because its dependency set (fumadocs, next, shiki tooling) evolves on a different cadence than the client libraries and a grouped PR mixing both would review terribly.
Grouping: fewer PRs, same signal
Everything groups minor and patch bumps together per ecosystem. The reasoning is risk-shaped: minor and patch updates are usually safe to evaluate as a batch, while major bumps stay individual PRs so each one gets a real migration conversation. For pyrpc-core that distinction is not academic; a major pydantic bump is an event with changelog reading attached, while six transitive patch bumps are Tuesday.
The interaction with our own versioning
One subtlety worth naming: Dependabot manages dependencies of pyRPC, never versions of pyRPC. Package versions remain governed by the lockstep release script, and Dependabot PRs touching only locks cannot drift them. The one place the two worlds meet is meaningful: when a dependency fix matters to users (the jsonc-edit Windows bootstrap fix shipping in 0.2.1), raising the floor in pyproject.toml is a maintainer decision made in a normal reviewed PR, exactly like any other change.
What it catches that humans do not
The value case arrived before the config even merged: the Windows CI leg exposed the jsonc-edit bootstrap crash, and the fix reached this repo as an explicit floor bump within hours. Multiply that loop by every dependency across both ecosystems, remove the human noticing step, and that is the entire feature.