Only pull in updates to direct dependencies
Only pull in updates to direct dependencies

We only want Dependabot to open a PR when there is an
update to a dependency we have explicitly named in this
config. We don't want it to raise a PR when if there is
an update to a subdependency.

Previously we tried specifying this setting
'system-wide' by having 'dependency-type: direct' as
its own array item. The [docs] implied this might be
possible. However, we're seeing PRs being raised for
non-named dependencies, so we think we'll have to
make our config more explicit.

[docs]: https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates\#allow

Trello: https://trello.com/c/uPoriyfJ/2049-add-dependabot-configuration-to-each-repo-blitz-pair

alphagov/asset-manager,alphagov/asset-manager,alphagov/asset-manager