A tiny Dependabot config
that watches WordPress core (installed via Composer as
roots/wordpress)A and opens a
pull request whenever a patch release ships — which is how WordPress
delivers security fixes (e.g. 6.8.7 → 6.8.8).
Minor and major releases (e.g. 6.8 → 6.9) are ignored on purpose — those
are plugin/theme compatibility decisions you make by hand.