From dd5977ff8c2d7d665692b418e80981611d233ae0 Mon Sep 17 00:00:00 2001 From: Andres Saa Date: Sat, 8 Aug 2026 18:43:14 +0200 Subject: [PATCH] ci: group security updates the way version updates are grouped `applies-to` defaults to version updates, so the existing catch-all group never applied to security advisories: those bypassed grouping and arrived as one pull request per package. One mermaid-cli upgrade landed as two of them, each a three-line lockfile edit, each carrying a full matrix run. The fix is a second group with the same membership and the other value, since a package with zero runtime dependencies has nothing to update here that is not dev tooling. Validated against the SchemaStore dependabot-2.0 schema, which is the only check available before the file reaches the default branch. --- .github/dependabot.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 111525d..f4e4269 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,7 +6,18 @@ updates: schedule: interval: "weekly" groups: + # Two groups with identical membership, because `applies-to` defaults to + # version updates: without the second one, security advisories bypass + # grouping entirely and arrive as one pull request per package. A single + # mermaid-cli upgrade landed as two that way. Both patterns take + # everything — a package with zero runtime dependencies has nothing here + # but dev tooling. dev-dependencies: + applies-to: version-updates + patterns: + - "*" + security-advisories: + applies-to: security-updates patterns: - "*" ignore: