Fix: Dependabot configuration has empty package-ecosystem, preventing automated updates

[vineet1cg]

Description

The Dependabot configuration at .github/dependabot.yml has an empty package-ecosystem field (""), which is invalid. Dependabot silently ignores this configuration and never checks for dependency updates, leaving the project vulnerable to known security issues in dependencies.

File

.github/dependabot.yml (line 8)

Current Configuration

version: 2
updates:
  - package-ecosystem: "" # See documentation for possible values
    directory: "/"
    schedule:
      interval: "weekly"

Expected Behavior

Dependabot should automatically create pull requests when dependency updates are available.

Proposed Fix

version: 2
updates:
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "weekly"

Why This Matters

Without Dependabot, the project relies on manual checks for dependency updates. Critical security patches in transitive dependencies (like langchain, groq, google-genai) may be missed.

Impact

Enables automated security and version updates for all pip dependencies listed in pyproject.toml.

Difficulty

Beginner - Simple 1-line configuration fix.

[Sk-Uruj]

Hi @vineet1cg , I would love to work on this issue and fix the Dependabot configuration package-ecosystem value. Could you please assign it to me? Thank you!

[SanjanaTech19]

hi @vineet1cg , i would like to work on this issue under ECSOC 26 . pls assign it to me

[Diwakar-odds]

Hello! I would like to work on this issue. Could you please assign it to me?

As this appears to be a core/L3 feature, here is my proposed implementation plan:

Implementation Plan

1. Analysis: Review the relevant files and trace the current execution path to ensure no side effects.
2. Implementation: Apply the necessary code changes/fixes according to the acceptance criteria.
3. Testing: Write/update unit tests to verify the fix and ensure existing tests pass.

Files to be Modified

• Relevant core service files related to this issue.
• Associated test files.

Could you also please apply the ECSoC26 label to this issue so it can be tracked for the contribution program? Thank you!