From 85132497d3fa3e4e78c5c413d08c0084d711064c Mon Sep 17 00:00:00 2001
From: Lucas Ramos <3140800+lucas-d-ramos@users.noreply.github.com>
Date: Mon, 21 Sep 2026 15:28:32 +0200
Subject: [PATCH] chore(dependabot): group security updates per ecosystem
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Security updates are a separate stream, and `groups` covers version updates only unless
told otherwise, so security fixes have been arriving one PR per advisory — the shape of
queue that got bulk-closed on 2026-08-18/21, recording per-version ignores on 95 alerts.
A grouped security PR is one PR instead of many, and it is the only kind that accepts
`@dependabot unignore`, so a hand-close stops being permanent. One `<eco>-security` group
per update entry (`applies-to: security-updates`, `patterns: ["*"]`); nothing else moves.
Cut from dependency-policy templates/tier*.yml (35c4034).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .github/dependabot.yml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index fbf99ed..240120a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -18,6 +18,13 @@ updates:
     groups:
       uv-minor-patch:
         update-types: ["minor", "patch"]
+      # Security updates are a separate stream; without this group they arrive one PR per
+      # advisory, which is what built the queues that got bulk-closed. A GROUPED PR is also
+      # the only kind `@dependabot unignore` works on. Canonical shape: dependency-policy
+      # templates/tier*.yml.
+      uv-security:
+        applies-to: security-updates
+        patterns: ["*"]
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
@@ -36,6 +43,13 @@ updates:
     groups:
       github-actions-minor-patch:
         update-types: ["minor", "patch"]
+      # Security updates are a separate stream; without this group they arrive one PR per
+      # advisory, which is what built the queues that got bulk-closed. A GROUPED PR is also
+      # the only kind `@dependabot unignore` works on. Canonical shape: dependency-policy
+      # templates/tier*.yml.
+      github-actions-security:
+        applies-to: security-updates
+        patterns: ["*"]
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]