From ef14d63aa1ef1346113c1b1c3cc3d8c979c800f3 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 10:14:32 +0000 Subject: [PATCH] Group Dependabot updates into weekly/single PRs to cut noise Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01TunfzDTnAar7MFXNjiY2B7 --- .github/dependabot.yml | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..aa3560408 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,32 @@ +version: 2 +updates: + # Web front end: one weekly PR sweeping every non-major bump, including transitive deps, + # so most security fixes land here rather than as individual PRs. + - package-ecosystem: "npm" + directory: "/web" + schedule: + interval: "weekly" + allow: + - dependency-type: "all" + ignore: + - dependency-name: "*" + update-types: ["version-update:semver-major"] + groups: + npm-weekly: + applies-to: version-updates + patterns: ["*"] + npm-security: + applies-to: security-updates + patterns: ["*"] + + # NuGet versions (Roslyn, VS SDK) are pinned deliberately for host compatibility, + # so no version updates - only group any security fixes into a single PR. + - package-ecosystem: "nuget" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 0 + groups: + nuget-security: + applies-to: security-updates + patterns: ["*"]