Group Dependabot security-advisory PRs per ecosystem

[3uzbcqje]

Groups Dependabot's security-advisory PRs, which the existing config does not cover.

A groups entry without applies-to defaults to version-updates only. So while minor/patch version updates have been arriving grouped since the last PR merged, security advisories still open one PR per advisory. This adds a second group per ecosystem that sets applies-to: security-updates.

Groups after this change

Ecosystem	Version updates	Security updates
npm	npm	npm-security
bundler	bundler	bundler-security
docker	docker	docker-security
docker-compose	docker-compose	docker-compose-security
github-actions	github-actions	github-actions-security

Notes

• The security groups use patterns: ["*"], so they include major bumps. That is deliberate — declining a security fix on the grounds that it is a major version bump is not a real option.
• This only affects PRs opened from the merge onward. Security PRs already open are not retroactively grouped and still need merging or closing by hand.
• Cooldown is untouched. Security updates are driven by Dependabot alerts, so urgent fixes are not delayed by the version-update schedule.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LpZM2dqedR4fXiLn7272XQ

[netlify]

✅ Deploy Preview for bettervoting ready!

Name	Link
🔨 Latest commit	c7d3807
🔍 Latest deploy log	https://app.netlify.com/projects/bettervoting/deploys/6aa44caba30b800008313eb3
😎 Deploy Preview	https://deploy-preview-1644--bettervoting.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: cfac4aca-2c4f-476c-bbd9-053ec7843c19

📥 Commits

Reviewing files that changed from the base of the PR and between dc26217 and c7d3807.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• Chores

  • Improved automated grouping of security-related dependency updates across supported package and tooling ecosystems.
  • Security advisories can now be grouped consistently, including major-version updates where applicable.

• Documentation

  • Added guidance clarifying how security-update grouping works and when major updates may be included.

Walkthrough

The Dependabot configuration now documents the applies-to: security-updates requirement for security-advisory groups. It also states that these groups can include major updates. Security-update groups now bundle matching advisories for npm, Bundler, Docker, Docker Compose, and GitHub Actions.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to c7d38

The configuration safely adds ecosystem-specific security-update grouping without changing existing version-update groups.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the primary change: grouping Dependabot security-advisory pull requests by ecosystem.
Description check	✅ Passed	The description explains the change, affected ecosystems, security-update behavior, major-version inclusion, and rollout limitations. The screenshots section is not applicable because this is a config…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependabot-security-grouping

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the update queue
Five little groups hop into view
npm and Bundler share the trail
Docker friends follow without fail
Safe patches gather, neat and bright}

_{Comment @coderabbitai help to get the list of available commands.}