Conversation
This was referenced Sep 18, 2026
Cargo and GitHub Actions classify all dependencies as production, so separate development groups never receive updates. Use one minor/patch version group and one unrestricted security group for each ecosystem. Closes #1000
sehkone
force-pushed
the
sehkone/issue-1000
branch
from
September 19, 2026 10:46
edfa342 to
5c21ed7
Compare
![octoaide[bot]](https://avatars.githubusercontent.com/in/1190418?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Overall: patch is correct — The patch correctly removes unsupported dependency-type distinctions while preserving minor/patch grouping, unrestricted security grouping, major-update eligibility, and all unrelated Dependabot settings. The configuration is valid and the PR checks pass.
No findings that block this change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Dependabot classifies all Cargo and GitHub Actions dependencies as production, so the development groups introduced by #168 cannot receive updates. Replace each ecosystem's production/development pairs with one minor/patch version-update group and one security-update group, without
dependency-typefilters.Major version updates remain ungrouped, and security updates retain no semantic-version restriction. Weekly schedules, labels, PR limits, directory settings, and the entire Docker entry are unchanged. Only
.github/dependabot.ymlchanges; no release-note entry is needed for this repository maintenance correction.Closes #1000
Validation
215eb13601406a389172e996ad1b0880864532ca, which includes the merged rustls security fix from Update rustls to fix TLS handshake validation #1003. Confirmed the Dependabot file is byte-for-byte identical to the version validated before the rebase and the lockfile matches updated main.cargo auditpassed after the rebase; the existing non-fatal unmaintainedrustls-pemfilewarning remains.git diff --checkpassed; the final PR diff still changes only.github/dependabot.yml.AGENTS.md: this Dependabot-only change affects no Docker lifecycle, E2E scripts, or application code paths. Full PR CI remains enabled and runs again for the rebased commit.Hosted Dependabot PR generation can only be observed after this configuration reaches the default branch and eligible updates exist; schema validation does not exercise that scheduler.