From 6555d72e6dade3271e110e50613b0718942806f4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gr=C3=A9goire=20Pineau?= Date: Wed, 9 Sep 2026 11:34:09 +0200 Subject: [PATCH] chore(ci): group dependabot security updates Dependabot groups only apply to version updates unless a group declares applies-to: security-updates, so security fixes were opened as one PR per dependency. Add a security group to each entry so alerts land in a single PR per ecosystem. Drop the redundant target-branch: main is already the default branch, and per the Dependabot docs an entry's settings do not apply to security updates where target-branch is used. --- .github/dependabot.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f9a487a7..36a328bd 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -2,12 +2,15 @@ version: 2 updates: - package-ecosystem: 'github-actions' directory: '/' - target-branch: 'main' schedule: interval: 'monthly' groups: github-actions: patterns: - '*' + github-actions-security: + applies-to: security-updates + patterns: + - '*' cooldown: default-days: 7