From 713bfadc19a93aed91cd2915da949a07cf79fc0b Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 10 Aug 2026 14:01:48 +0000 Subject: [PATCH] Dependabot: group PRs; security-only for app dependencies MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Grouping collapses each ecosystem's updates into a single PR instead of one per package. `applies-to` matters: a group covers version updates unless told otherwise, so the security-only ecosystems spell it out. npm and uv are security-only via open-pull-requests-limit: 0, which switches off routine version-bump PRs while security updates — exempt from that limit — keep coming. That stops repeats of the setuptools constraint bumps that had to be fixed upstream anyway. GitHub Actions keeps its routine bumps: advisories for actions are rare, so making it security-only would effectively freeze action versions. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_011texLkDBELWbXsBf6San3M --- .github/dependabot.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index a74969e..9073435 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,14 +1,30 @@ version: 2 +# Grouping keeps each ecosystem's updates to a single PR instead of one per +# package. Note `applies-to`: a group covers version updates unless told +# otherwise, so security-only ecosystems need it spelled out. updates: + # Actions keep their routine bumps — advisories for them are rare, so waiting + # for one would freeze the versions. - package-ecosystem: github-actions directory: / schedule: interval: weekly + groups: + actions: + patterns: ["*"] + # Application dependencies: security updates only. `open-pull-requests-limit: 0` + # switches off routine version-bump PRs; security updates ignore that limit and + # keep coming. - package-ecosystem: npm directory: /frontend schedule: interval: weekly + open-pull-requests-limit: 0 + groups: + frontend-security: + applies-to: security-updates + patterns: ["*"] # The backend package lives in a subdirectory, so it needs its own entry # (`uv.lock` there is already picked up by the dependency graph, but an entry @@ -17,3 +33,8 @@ updates: directory: /backend schedule: interval: weekly + open-pull-requests-limit: 0 + groups: + backend-security: + applies-to: security-updates + patterns: ["*"]