From a8a588c8a4b3d5ee9c591b3ae9f4db39561dc817 Mon Sep 17 00:00:00 2001 From: Zachary Smith Date: Thu, 22 Oct 2026 13:13:48 -0400 Subject: [PATCH] Group dependabot updates by ecosystem to cut PR volume Merging the deploy pipeline introduced several new GitHub Actions dependencies at once, and dependabot opened one PR per dependency -- five at once, with more to follow weekly. Grouping minor/patch bumps (and all github-actions bumps, which don't carry the same semver risk) batches them into a single PR per ecosystem per run. Majors are left ungrouped so they still get individual review. Co-Authored-By: Claude Sonnet 5 --- .github/dependabot.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6793c26..8ad14d5 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,13 +4,29 @@ updates: directory: "/" schedule: interval: "weekly" + groups: + # Majors are left out of the group so they still open as their own PR + # and get a closer look -- only minor/patch bumps get batched. + pip-minor-patch: + update-types: + - "minor" + - "patch" - package-ecosystem: "github-actions" directory: "/" schedule: interval: "weekly" + groups: + github-actions: + patterns: + - "*" - package-ecosystem: "docker" directory: "/" schedule: interval: "weekly" + groups: + docker-minor-patch: + update-types: + - "minor" + - "patch"