From 4a1af45ec572c8d2eaabc3301be93c3f5a37c715 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 19 Oct 2026 05:55:09 +0000
Subject: [PATCH 1/3] Initial plan


From 8c4b936243b1dce18be75f2460a344421b0ccea7 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 19 Oct 2026 05:56:54 +0000
Subject: [PATCH 2/3] fix: track Python SDK and MCP dependencies with
 Dependabot

Co-authored-by: groupthinking <154503486+groupthinking@users.noreply.github.com>
---
 .github/dependabot.yml                        | 16 +++++++++++++-
 .../test_dependabot_automation_workflow.py    | 22 +++++++++++++++++++
 2 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9cd5344fb..8fc1634b9 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -22,7 +22,7 @@ updates:
       - dependency-name: "eslint"
         versions: [">=10"]
 
-  # Python backend dependencies.
+  # Python backend dependencies (root pyproject.toml and requirements.txt).
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
@@ -35,6 +35,20 @@ updates:
       interval: "weekly"
     open-pull-requests-limit: 10
 
+  # Python SDK dependencies.
+  - package-ecosystem: "pip"
+    directory: "/sdk/python"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+
+  # MCP YouTube server dependencies.
+  - package-ecosystem: "pip"
+    directory: "/docs/knowledge_prototypes/mcp-servers/mcp_youtube-0.2.0"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+
   # GitHub Actions versions.
   - package-ecosystem: "github-actions"
     directory: "/"
diff --git a/tests/unit/test_dependabot_automation_workflow.py b/tests/unit/test_dependabot_automation_workflow.py
index 6719b26af..d249230eb 100644
--- a/tests/unit/test_dependabot_automation_workflow.py
+++ b/tests/unit/test_dependabot_automation_workflow.py
@@ -27,6 +27,28 @@ def _load_dependabot_config() -> dict:
     return yaml.safe_load(DEPENDABOT_CONFIG_PATH.read_text())
 
 
+@pytest.mark.parametrize(
+    "directory",
+    [
+        "/",
+        "/src/youtube_extension/backend",
+        "/sdk/python",
+        "/docs/knowledge_prototypes/mcp-servers/mcp_youtube-0.2.0",
+    ],
+)
+def test_dependabot_tracks_python_packages_weekly(directory: str) -> None:
+    updates = [
+        update
+        for update in _load_dependabot_config()["updates"]
+        if update["package-ecosystem"] == "pip"
+        and update["directory"] == directory
+    ]
+
+    assert len(updates) == 1, f"Expected exactly one pip entry for {directory}"
+    assert updates[0]["schedule"]["interval"] == "weekly"
+    assert updates[0]["open-pull-requests-limit"] == 10
+
+
 def test_dependabot_workflow_uses_safe_triggers_and_permissions() -> None:
     workflow = _load_workflow()
 

From 5b5198d142659ec249214abc2c57d45caea0a6da Mon Sep 17 00:00:00 2001
From: Hayden <154503486+groupthinking@users.noreply.github.com>
Date: Wed, 28 Oct 2026 06:20:40 -0500
Subject: [PATCH 3/3] fix: track MCP server dependencies with uv

---
 .github/dependabot.yml                        |  4 +--
 .../test_dependabot_automation_workflow.py    | 25 +++++++++----------
 2 files changed, 14 insertions(+), 15 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8fc1634b9..0a198fbdb 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -42,8 +42,8 @@ updates:
       interval: "weekly"
     open-pull-requests-limit: 10
 
-  # MCP YouTube server dependencies.
-  - package-ecosystem: "pip"
+  # MCP YouTube server dependencies (pyproject.toml and uv.lock).
+  - package-ecosystem: "uv"
     directory: "/docs/knowledge_prototypes/mcp-servers/mcp_youtube-0.2.0"
     schedule:
       interval: "weekly"
diff --git a/tests/unit/test_dependabot_automation_workflow.py b/tests/unit/test_dependabot_automation_workflow.py
index d249230eb..9601894d8 100644
--- a/tests/unit/test_dependabot_automation_workflow.py
+++ b/tests/unit/test_dependabot_automation_workflow.py
@@ -1,9 +1,5 @@
 from __future__ import annotations
 
-import json
-import re
-import shutil
-import subprocess
 from pathlib import Path
 
 import pytest
@@ -28,23 +24,26 @@ def _load_dependabot_config() -> dict:
 
 
 @pytest.mark.parametrize(
-    "directory",
+    ("directory", "ecosystem"),
     [
-        "/",
-        "/src/youtube_extension/backend",
-        "/sdk/python",
-        "/docs/knowledge_prototypes/mcp-servers/mcp_youtube-0.2.0",
+        ("/", "pip"),
+        ("/src/youtube_extension/backend", "pip"),
+        ("/sdk/python", "pip"),
+        ("/docs/knowledge_prototypes/mcp-servers/mcp_youtube-0.2.0", "uv"),
     ],
 )
-def test_dependabot_tracks_python_packages_weekly(directory: str) -> None:
+def test_dependabot_tracks_python_packages_weekly(
+    directory: str, ecosystem: str
+) -> None:
     updates = [
         update
         for update in _load_dependabot_config()["updates"]
-        if update["package-ecosystem"] == "pip"
-        and update["directory"] == directory
+        if update["directory"] == directory
+        and update["package-ecosystem"] in {"pip", "uv"}
     ]
 
-    assert len(updates) == 1, f"Expected exactly one pip entry for {directory}"
+    assert len(updates) == 1, f"Expected exactly one entry for {directory}"
+    assert updates[0]["package-ecosystem"] == ecosystem
     assert updates[0]["schedule"]["interval"] == "weekly"
     assert updates[0]["open-pull-requests-limit"] == 10