From 3d941069e501d8795601a5970e1a16b41f81a6d8 Mon Sep 17 00:00:00 2001
From: Victor Kuznetsov <kuznetsov.va@gmail.com>
Date: Thu, 30 Jul 2026 16:21:50 -0700
Subject: [PATCH] Keep Dependabot updates within compatible dependency lines

---
 .github/dependabot.yml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 402d72c..73bf8b8 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -14,6 +14,21 @@ updates:
         update-types:
           - "minor"
           - "patch"
+    # The `all` extra must remain jointly resolvable. These candidates violate
+    # upstream constraints: TrustMark still requires NumPy 1.x, OpenCV 5 requires
+    # NumPy 2 on newer Python versions, and this project keeps tokenizers below
+    # 0.23 for the stable Transformers path. Keep Dependabot on the compatible
+    # lines until those constraints move.
+    ignore:
+      - dependency-name: "numpy"
+        versions:
+          - ">=2"
+      - dependency-name: "opencv-python-headless"
+        versions:
+          - ">=5"
+      - dependency-name: "tokenizers"
+        versions:
+          - ">=0.23"
 
   - package-ecosystem: "github-actions"
     directory: "/"