version: 2
updates:
  - package-ecosystem: "composer"
    directory: "/"
    schedule:
      interval: "weekly"
    # Auto-merge security updates is handled separately; label security PRs with `security`.
    open-pull-requests-limit: 8
    rebase-strategy: "auto"
    labels:
      - "dependencies"
      - "dependabot"
    # Dependabot will create security and regular dependency update PRs.