Dependabot: group PRs; security-only for app dependencies - #18
Merged
Conversation
Grouping collapses each ecosystem's updates into a single PR instead of one per package. `applies-to` matters: a group covers version updates unless told otherwise, so the security-only ecosystems spell it out. npm and uv are security-only via open-pull-requests-limit: 0, which switches off routine version-bump PRs while security updates — exempt from that limit — keep coming. That stops repeats of the setuptools constraint bumps that had to be fixed upstream anyway. GitHub Actions keeps its routine bumps: advisories for actions are rare, so making it security-only would effectively freeze action versions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011texLkDBELWbXsBf6San3M
albertotb
force-pushed
the
claude/dependabot-security-only
branch
from
August 10, 2026 14:04
bae0134 to
713bfad
Compare
albertotb
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Grouped — each ecosystem collapses its updates into a single PR instead of one per package.
Security-only for npm and uv —
open-pull-requests-limit: 0switches off routine version-bump PRs; security updates are exempt from that limit and keep coming. That's what stops repeats of #14/#15, thesetuptoolsconstraint bumps that had to go upstream anyway.GitHub Actions keeps its routine bumps — advisories for actions are rare, so making it security-only would effectively freeze action versions (no more
checkout@v7-style updates). Its bumps are now grouped into one PR instead of arriving separately.The
applies-tokey is the easy-to-miss part: a group covers version updates unless told otherwise, so on the security-only ecosystems it has to be spelled out or the grouping would apply to exactly the PRs that are now disabled.GitHub validates
dependabot.ymlon push, so the.github/dependabot.ymlcheck on this PR is the real confirmation the syntax is accepted.Kept on its own branch so it doesn't mix into #16, which is still under review.
🤖 Generated with Claude Code
https://claude.ai/code/session_011texLkDBELWbXsBf6San3M