From 320c571c56cd6d56e03d295a7572876e82eb04f2 Mon Sep 17 00:00:00 2001 From: Pablo Rodriguez Date: Wed, 23 Sep 2026 04:24:12 -0700 Subject: [PATCH] cap the open dependabot backlog and group what needs no separate review Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 782a0ad..bc29f52 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,10 +1,22 @@ version: 2 +# One grouped pull request per ecosystem per week is the normal case; the cap is what keeps a +# missed week from compounding into a backlog. updates: - package-ecosystem: "npm" directory: "/" schedule: interval: "weekly" + open-pull-requests-limit: 3 + groups: + minor-and-patch: + update-types: ["minor", "patch"] - package-ecosystem: "github-actions" directory: "/" schedule: interval: "weekly" + open-pull-requests-limit: 3 + groups: + # Majors are grouped here too: an action pin merges on green with no model either way, so a + # separate pull request per major buys nothing but CI minutes. + actions: + patterns: ["*"]