Add a dependabot.yml and bump deps

.github/dependabot.yml

@@ -0,0 +1,24 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "quarterly"
+    groups:
+      actions:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 14
+
+  # Covers requirements.txt, requirements-dev.txt, deploy-requirements.txt,
+  # setup.py and setup.cfg.
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "quarterly"
+    groups:
+      pip:
+        patterns: ["*"]
+    cooldown:
+      default-days: 14

.github/workflows/test.yml

@@ -27,6 +27,11 @@ jobs:
       matrix:
         python-version: ["3.12", "3.13", "3.14"]
         django: ["5.2", "6.1"]
+        include:
+          # The production server runs Python 3.10, which Django 6 does
+          # not support, so only test it with Django 5.2.
+          - python-version: "3.10"
+            django: "5.2"
     name: Python ${{ matrix.python-version }} / Django ${{ matrix.django }}
     env:
       DJANGO_SETTINGS_MODULE: codespeed.tests.settings

deploy-requirements.txt

@@ -1,3 +1,5 @@
+# The production server runs Python 3.10.12, so pins must stay installable
+# there.
 -r requirements.txt
-psycopg2-binary==2.9.9
-gunicorn==21.2.0
+psycopg2-binary==2.9.13
+gunicorn==26.2.0

requirements.txt

@@ -1,3 +1,5 @@
+# The production server runs Python 3.10.12, so pins must stay installable
+# there.
 django>=5.2,<7
-isodate==0.6.1
+isodate==0.7.2
 matplotlib