chore(deps): consolidate dependabot into one grouped PR, minor/patch only

[3uzbcqje]

Part of an org-wide Dependabot consolidation. This repo currently has 5 open Dependabot PRs.

What changes

1. Routine updates are minor/patch only.

ignore:
  - dependency-name: "*"
    update-types:
      - version-update:semver-major

The version-update: prefix scopes this to version updates. Security updates are filtered separately, so an advisory whose only fix is a major bump still opens a PR. Dropping the update-types: key would turn this into a blanket ignore that silences security updates too — there's a comment in the file saying so.

2. One PR instead of one per dependency. multi-ecosystem-groups merges cargo + pip + docker + github-actions into a single weekly PR. This is the exact shape proven on alaska-rcv.

3. Security advisories grouped separately via *-security groups with applies-to: security-updates, so they arrive as one PR per ecosystem rather than one per advisory.

Proven on alaska-rcv

This mirrors the config now running on alaska-rcv, which took 15 open Dependabot PRs down to 1 and correctly suppressed major bumps (@mui/material 7.1.0→9.3.1 became 7.1.0→7.3.11; node 20.11.1→26.8 became 20.11.1→20.20.2).

Two things that pilot taught us, both encoded here:

• open-pull-requests-limit must not appear on an update entry belonging to a multi-ecosystem group — Dependabot rejects the entire file, and the published JSON schema does not catch it. It's omitted on multi-ecosystem repos entirely.
• A multi-ecosystem group has no applies-to key, so it covers version updates only. Hence the separate *-security groups.

Note on merging

Nothing takes effect until this is merged — Dependabot only reads config from the default branch. Stale PRs will be closed separately, after this is confirmed parsing, and only ones with no matching security alert. This repo has 0 open security alerts, so nothing here is a security PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FpuRSSAYEkdSSgnaFaoBKK

Summary by CodeRabbit

• Chores
  • Updated automated dependency management to consolidate supported ecosystems into a single weekly update group.
  • Added separate security-update grouping for each ecosystem.
  • Configured updates to cover all packages while excluding major version updates from routine version upgrades.
  • Removed per-ecosystem scheduling and pull request limit settings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 71481f5e-9594-4b7d-bd3a-5148545b6be2

📥 Commits

Reviewing files that changed from the base of the PR and between b947bed and 90fb5ac.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Dependabot now combines cargo, pip, Docker, and GitHub Actions updates into one weekly group. Each ecosystem ignores semver-major version updates and has a separate security-update group.

Changes

Dependabot update policy

Layer / File(s)	Summary
Weekly multi-ecosystem group .github/dependabot.yml	Adds a shared Monday 06:00 schedule and the dependencies label.
Ecosystem update policies .github/dependabot.yml	Adds shared grouping, wildcard patterns, semver-major ignore rules, and security groups for cargo, pip, Docker, and GitHub Actions. Removes per-ecosystem schedules, pull request limits, and minor/patch groups.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 90fb5

The configuration preserves major-version security updates while limiting routine updates. No actionable merge risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main changes: consolidating Dependabot updates into one grouped pull request and limiting routine updates to minor and patch versions. It omits the separate security-up…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependabot-consolidate

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}