chore(deps): consolidate dependabot into one grouped PR, minor/patch only

[3uzbcqje]

Part of an org-wide Dependabot consolidation. This repo currently has 4 open Dependabot PRs.

What changes

1. Routine updates are minor/patch only.

ignore:
  - dependency-name: "*"
    update-types:
      - version-update:semver-major

The version-update: prefix scopes this to version updates. Security updates are filtered separately, so an advisory whose only fix is a major bump still opens a PR. Dropping the update-types: key would turn this into a blanket ignore that silences security updates too — there's a comment in the file saying so.

2. One PR instead of one per dependency. multi-ecosystem-groups merges pip + github-actions into a single weekly PR. This is the exact shape proven on alaska-rcv.

3. Security advisories grouped separately via *-security groups with applies-to: security-updates, so they arrive as one PR per ecosystem rather than one per advisory.

Proven on alaska-rcv

This mirrors the config now running on alaska-rcv, which took 15 open Dependabot PRs down to 1 and correctly suppressed major bumps (@mui/material 7.1.0→9.3.1 became 7.1.0→7.3.11; node 20.11.1→26.8 became 20.11.1→20.20.2).

Two things that pilot taught us, both encoded here:

• open-pull-requests-limit must not appear on an update entry belonging to a multi-ecosystem group — Dependabot rejects the entire file, and the published JSON schema does not catch it. It's omitted on multi-ecosystem repos entirely.
• A multi-ecosystem group has no applies-to key, so it covers version updates only. Hence the separate *-security groups.

Note on merging

Nothing takes effect until this is merged — Dependabot only reads config from the default branch. Stale PRs will be closed separately, after this is confirmed parsing, and only ones with no matching security alert. This repo has 0 open security alerts, so nothing here is a security PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FpuRSSAYEkdSSgnaFaoBKK

Summary by CodeRabbit

• Chores
  • Automated dependency maintenance has been consolidated into a weekly update cycle.
  • Security-related dependency updates continue to be handled separately.
  • Major-version updates remain excluded from automated update proposals to reduce unexpected compatibility changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 1e540047-8176-4501-ac19-663919910bd1

📥 Commits

Reviewing files that changed from the base of the PR and between a24be9c and 2e3fc28.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Changes

Dependabot update policy

Layer / File(s)	Summary
Shared dependency grouping .github/dependabot.yml	The configuration adds the all-dependencies group with a weekly Monday 06:00 schedule and the dependencies label.
Ecosystem update rules .github/dependabot.yml	Pip and GitHub Actions updates use wildcard matching, ignore semver-major versions, retain seven-day cooldowns, and group security updates separately. Individual schedules, PR limits, and minor/patch groups are removed.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 2e3fc

The dependency-update policy remains internally consistent, with routine major updates excluded and security updates retained. No merge-blocking issue is identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main changes: consolidating Dependabot updates into one grouped pull request and limiting routine updates to minor and patch versions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependabot-consolidate

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}