From 810b44c416c9a9a2acf9682357c5473ebdc04a03 Mon Sep 17 00:00:00 2001 From: Sean Rankine Date: Thu, 29 Oct 2026 14:48:46 +0000 Subject: [PATCH 1/5] Group dependency bumps for GitHub Actions We get a steady stream of PRs to bump actions, most of them for `ruby/setup-ruby`, which releases most weeks. Bumping our actions is low risk, so we can review them together in one PR each week. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c36f874c8..f6f71dea9 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -14,6 +14,10 @@ updates: cooldown: default-days: 7 open-pull-requests-limit: 10 + groups: + github-actions: + patterns: + - "*" # Maintain dependencies for Ruby/Rails bundler - package-ecosystem: "bundler" From 16a22512fdc14255c22c3e22f040668d541d385a Mon Sep 17 00:00:00 2001 From: Sean Rankine Date: Thu, 29 Oct 2026 14:48:55 +0000 Subject: [PATCH 2/5] Group gem bumps by development and production Each week brings a few gem bumps, but they're spread across lots of gems, so the groups for specific gems still leave us with mostly single-gem PRs. Grouping minor and patch bumps by Gemfile group gives us at most two PRs a week, and keeps test tooling bumps separate from the gems we run in production. The AWS SDK gems now fall into the production group. The Sentry and Vite Ruby groups only need to handle major bumps, which the new groups leave out, so those gems still get bumped together. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f6f71dea9..09c63b3f2 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -31,17 +31,32 @@ updates: allow: - dependency-type: "direct" - dependency-name: "vite_ruby" + # A dependency goes in the first group it matches, so order matters groups: - aws-sdk: - patterns: - - "aws-sdk-*" + # These gems must be bumped together. Minor and patch bumps fall through + # to the groups below; only majors get their own PR here. sentry: patterns: - "sentry-*" + update-types: + - "major" vite_ruby: patterns: - "vite_rails" - "vite_ruby" + update-types: + - "major" + # Gems in the :development and :test Gemfile groups + bundler-development: + dependency-type: "development" + update-types: + - "minor" + - "patch" + bundler-production: + dependency-type: "production" + update-types: + - "minor" + - "patch" # Maintain dependencies for npm - package-ecosystem: npm From 4cc586b7e88f3d23495b9fc989a98459f0f48ea0 Mon Sep 17 00:00:00 2001 From: Sean Rankine Date: Thu, 29 Oct 2026 14:49:02 +0000 Subject: [PATCH 3/5] Raise Rails minor upgrades in their own PR Rails minor releases can change framework defaults and deprecate behaviour, so we want to review them on their own rather than as part of the production gems group. Rails patch releases are still grouped. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 09c63b3f2..1114f7a01 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -46,6 +46,12 @@ updates: - "vite_ruby" update-types: - "major" + # Rails minor upgrades get their own PR; patches go in bundler-production + rails: + patterns: + - "rails" + update-types: + - "minor" # Gems in the :development and :test Gemfile groups bundler-development: dependency-type: "development" From 004657b6d1900bfa63bb4d3c9c7656a1391b1e8f Mon Sep 17 00:00:00 2001 From: Sean Rankine Date: Thu, 29 Oct 2026 15:01:42 +0000 Subject: [PATCH 4/5] Group dependency bumps for npm dev dependencies Most of our npm PRs are for build and test tooling such as Vite, Vitest, Sass and PostCSS, which release often. Our CI checks that a bump to these still builds and passes tests, so they can share a weekly PR. govuk-frontend and dfe-autocomplete change what users see, so they still get their own PRs. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1114f7a01..6ffa096f4 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -73,6 +73,14 @@ updates: cooldown: default-days: 7 open-pull-requests-limit: 10 + # Production dependencies (govuk-frontend, dfe-autocomplete) stay as + # individual PRs + groups: + npm-development: + dependency-type: "development" + update-types: + - "minor" + - "patch" - package-ecosystem: terraform directory: ".review_apps/" From 8cab322b49df910d21c1a7906896428d9bd71180 Mon Sep 17 00:00:00 2001 From: Sean Rankine Date: Thu, 29 Oct 2026 14:49:20 +0000 Subject: [PATCH 5/5] Group Dependabot security updates Version update groups don't apply to Dependabot security updates, so these still arrive one dependency at a time, mostly for packages we don't depend on directly, such as undici, js-yaml, rack and nokogiri. Grouping them per ecosystem means fewer PRs to review. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6ffa096f4..658928b32 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -33,6 +33,10 @@ updates: - dependency-name: "vite_ruby" # A dependency goes in the first group it matches, so order matters groups: + bundler-security-updates: + applies-to: security-updates + patterns: + - "*" # These gems must be bumped together. Minor and patch bumps fall through # to the groups below; only majors get their own PR here. sentry: @@ -76,6 +80,10 @@ updates: # Production dependencies (govuk-frontend, dfe-autocomplete) stay as # individual PRs groups: + npm-security-updates: + applies-to: security-updates + patterns: + - "*" npm-development: dependency-type: "development" update-types: