From 171df8c36e7f924b379fb777e99ba3db6ff88e8f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jo=C3=A3o=20Pedro=20Brun?= Date: Tue, 15 Sep 2026 14:11:07 -0300 Subject: [PATCH 1/3] update dependabot --- .github/dependabot.yml | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b31adad0..2cf46495 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,22 +1,24 @@ version: 2 updates: - # Python pip dependencies - security updates only - # Regular version updates are disabled because we use compatible release - # constraints (~=) in pyproject.toml to pin patch versions. - # Dependabot Security Updates (enabled in repo settings) bypass these rules. + # Python pip dependencies + # Non-major (minor + patch) version updates are batched into one grouped PR; + # majors are left ungrouped so each breaking bump lands in its own PR for + # review. Security updates (enabled in repo settings) come as a separate grouped PR of their own - package-ecosystem: "pip" directory: "/" schedule: interval: "weekly" day: "monday" time: "09:00" - # Ignore all regular version updates - security updates still come through - ignore: - - dependency-name: "*" + groups: + version-minor-patch: update-types: - - "version-update:semver-major" - - "version-update:semver-minor" - - "version-update:semver-patch" + - "minor" + - "patch" + security: + applies-to: security-updates + patterns: + - "*" # Commit message configuration commit-message: prefix: "chore" @@ -39,6 +41,13 @@ updates: labels: - "dependencies" - "github-actions" + # Batch all Actions bumps (including majors) into one PR: a bad major fails + # the workflow loudly on the PR, so isolating them buys little and only adds + # churn + groups: + github-actions: + patterns: + - "*" commit-message: prefix: "chore" include: "scope" From c5727a234916c79f0848794d3297f3030249bd35 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jo=C3=A3o=20Pedro=20Brun?= Date: Tue, 15 Sep 2026 14:13:13 -0300 Subject: [PATCH 2/3] add dependencies label and explict * --- .github/dependabot.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 2cf46495..843f17c7 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,7 +3,8 @@ updates: # Python pip dependencies # Non-major (minor + patch) version updates are batched into one grouped PR; # majors are left ungrouped so each breaking bump lands in its own PR for - # review. Security updates (enabled in repo settings) come as a separate grouped PR of their own + # review. Security updates (enabled in repo settings) come as a separate + # grouped PR of their own - package-ecosystem: "pip" directory: "/" schedule: @@ -12,6 +13,8 @@ updates: time: "09:00" groups: version-minor-patch: + patterns: + - "*" update-types: - "minor" - "patch" @@ -19,6 +22,8 @@ updates: applies-to: security-updates patterns: - "*" + labels: + - "dependencies" # Commit message configuration commit-message: prefix: "chore" From 846c3d3f31490cbfdf7c2e5c7e0f18c1179e8208 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jo=C3=A3o=20Pedro=20Brun?= Date: Tue, 15 Sep 2026 14:25:53 -0300 Subject: [PATCH 3/3] trim comment --- .github/dependabot.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 843f17c7..d54937ea 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -46,9 +46,7 @@ updates: labels: - "dependencies" - "github-actions" - # Batch all Actions bumps (including majors) into one PR: a bad major fails - # the workflow loudly on the PR, so isolating them buys little and only adds - # churn + # Batch all Actions bumps (including majors) into one PR groups: github-actions: patterns: