From dce8e47fc67f4bc0dcde650bb2093ba44a9349f6 Mon Sep 17 00:00:00 2001
From: andromia3 <225720212+andromia3@users.noreply.github.com>
Date: Sun, 11 Oct 2026 11:23:56 +0100
Subject: [PATCH] Fix Dependabot security limits and Angular group precedence

Signed-off-by: andromia3 <225720212+andromia3@users.noreply.github.com>
---
 skills/dependabot/SKILL.md                               | 2 +-
 skills/dependabot/references/dependabot-yml-reference.md | 2 +-
 skills/dependabot/references/example-configs.md          | 7 ++++---
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/skills/dependabot/SKILL.md b/skills/dependabot/SKILL.md
index 710ccb6c4f..838827a0bd 100644
--- a/skills/dependabot/SKILL.md
+++ b/skills/dependabot/SKILL.md
@@ -386,7 +386,7 @@ Allow rebase over extra commits by including `[dependabot skip]` in commit messa
 ### Open PR Limit
 
 ```yaml
-open-pull-requests-limit: 10  # default is 5 for version, 10 for security
+open-pull-requests-limit: 10  # default is 5 for version updates; security updates are not limited
 ```
 
 Set to `0` to disable version updates entirely.
diff --git a/skills/dependabot/references/dependabot-yml-reference.md b/skills/dependabot/references/dependabot-yml-reference.md
index e0098349e5..2ba6770c1e 100644
--- a/skills/dependabot/references/dependabot-yml-reference.md
+++ b/skills/dependabot/references/dependabot-yml-reference.md
@@ -284,7 +284,7 @@ cooldown:
 open-pull-requests-limit: 10  # default: 5 for version updates
 ```
 
-Set to `0` to disable version updates entirely. Security updates have a separate internal limit of 10.
+Set to `0` to disable version updates entirely. Security update pull requests do not count toward this limit and have no limit on the number open.
 
 ## Advanced Options
 
diff --git a/skills/dependabot/references/example-configs.md b/skills/dependabot/references/example-configs.md
index 04442a5e36..81f11edcd5 100644
--- a/skills/dependabot/references/example-configs.md
+++ b/skills/dependabot/references/example-configs.md
@@ -270,15 +270,16 @@ updates:
       time: "09:00"
       timezone: "America/New_York"
     groups:
+      # Specific groups precede broad groups because the first matching group wins.
+      angular:
+        patterns: ["@angular*"]
+        update-types: ["minor", "patch"]
       dev-dependencies:
         dependency-type: "development"
         update-types: ["minor", "patch"]
       production-dependencies:
         dependency-type: "production"
         update-types: ["minor", "patch"]
-      angular:
-        patterns: ["@angular*"]
-        update-types: ["minor", "patch"]
       security-patches:
         applies-to: security-updates
         patterns: ["*"]