Do pip updates for bugfix branches

Author: hugovk

.github/dependabot.yml

@@ -17,6 +17,17 @@ updates:
       # highest-risk window immediately after new releases.
       default-days: 14
 
+  - package-ecosystem: "pip"
+    directory: "/Tools/"
+    schedule:
+      interval: "quarterly"
+    labels: ["skip issue", "skip news"]
+    groups:
+      pip:
+        patterns: ["*"]
+    cooldown:
+      default-days: 14
+
   # Release branches: Dependabot only reads this file from the default
   # branch, so each branch that should get its own actions bumps needs an
   # entry here with `target-branch`. Add one when a new release branch is
@@ -93,7 +104,34 @@ updates:
     cooldown:
       default-days: 14
 
+  # Only bump bugfix branches for pip. Remove
+  # the entry when branch goes security-only.
+  - package-ecosystem: "pip"
+    target-branch: "3.15"
+    directory: "/Tools/"
+    schedule:
+      interval: "quarterly"
+    labels: ["skip issue", "skip news"]
+    groups:
+      pip:
+        patterns: ["*"]
+    cooldown:
+      default-days: 14
+
+  - package-ecosystem: "pip"
+    target-branch: "3.14"
+    directory: "/Tools/"
+    schedule:
+      interval: "quarterly"
+    labels: ["skip issue", "skip news"]
+    groups:
+      pip:
+        patterns: ["*"]
+    cooldown:
+      default-days: 14
+
   - package-ecosystem: "pip"
+    target-branch: "3.13"
     directory: "/Tools/"
     schedule:
       interval: "quarterly"